A dossier assignment

Managerial Challenges of the Contemporary Society, vol. 7 no. 1

119

THE IMPORTANCE OF RISK MANAGMENT FOR MANAGERS

H. LECK1 1 Babeş-Bolyai University, hod38@bezeqint.net

ABSTRACT Accidents don’t happen by themselves, they are caused accidentally, in contract to deliberate events. In most organizations in the world the most valuable asset is the human resource. The human workers are in charge of the planning, manufacturing, building, packing, shipping and selling of any kind of product. Workers who are injured affectively hinder the organizations goals. The immediate consequences are losses, immediate and long termed; therefore any injured worker affects the organizations resistance. Managers should investigate the causes of these accidents and thereby prevent future accidents and achieving goals they set for themselves regarding safety. Managers at all levels should pin-point the hazards and investigate the factors which could lead to accidents. Early theories regarding safety (Heinrich, 1980) used phrases as “unsafe behavior” and “unsafe condition”. Nowadays, the most advanced theories are inclusive theories which relate to factors such as immediate execution factors, management efficiency, management types regarding safety, risk management etc. This approach was developed in the late 70’s during the convention of atomic energy in the US (Johnson, 1980). The theory maps out the hazard points which lead to the accidents, concerning the management level and the workers level. In fact the “root cause analysis” was adopted in Israel in 2000. The main idea is that each manager will be legally, lawfully, criminally and morally responsible to manage the risks on his watch. Keywords: Management, risk, accident, hazard, and injury.

JEL Classification: D81

1. Introduction

Immediate and critical factors in contrast to indirect, systemic and deep-seated factors. When discussing the causes of accidents one must distinguish between immediate factors which cause the accident directly and indirect factors which raise the probability for an accident, though not causing it directly. For instance, a forklift driver can miss and run over a stone on the road causing the forklift to tip over. The direct cause of this accident is the contact between the wheel and the stone and maybe also the driver who was not paying enough attention. But this accident may have, in addition, more profound causes such as the driver being tired after a ten hour shift, poor maintenance of the factory roads, lack of safety guidance for the drivers etc. As demonstrated, there is a huge difference between the immediate and indirect causes.

Therefore there are two main theories regarding accident causes; theories which focus mainly on the critical event that caused the accident (an event that can be referred to as the malfunction mechanism), and theories that focus mainly on the indirect and deep-seated causes. As can be deduced, theories that focus on the critical event are much simpler and don’t deal with complicated theoretical considerations. Theories that focus on deep-seated causes are often more complex, are multi-layered and use theories from the fields of psychology and management. This paper will discuss both types of theories.

2. Basic models of accidents

Basic models of accidents try to describe or explain how the critical event that caused the accident happened without trying to explain the indirect and environmental factors that led to the accident. These models describe a typical chain of events that end with an injury in order to achieve a basic understanding of the malfunction mechanisms involved in accidents. Most of the more complex theories of accident causes are based on basic models that relate to the critical event that caused the injury. There are five major models that try to explain how the critical event happens:

• The injury causation model- the “classic” safety model which is based on the presence of a risk factor that due to a “malfunction” or “error” caused the injury or damage.

• Occupational hygiene model- this model explains the injury in terms of exposure of the human to the environment risk factor.

• The “energy” model- this model sees the accident as a result of an uncontrolled energy passage through a man or equipment.

• The “change” model- this model argues that at the base of any accident is a change in one of the regular stages of the work process.

• The ergonomic model- this model sees the accident as a lack of compatibility between the organizations needs and the humans’ actions.

Each one of these models is important in order to understand the occurrence of accidents, as each one of them focuses on the accident from a different point of view. The injury causation model This is the basic safety model which explains the occurrence of an accident as a combination of two factors:

• A hazard with the potential of injury.

Managerial Challenges of the Contemporary Society, vol. 7 no. 1

120

• A “malfunction” or “error” which fulfilled the hazard potential and made the injury or damage possible.

Illustration number 1: The injury causation model As described in illustration number 1, the presence of a risk factor is not enough to cause an accident. The potential for harm is fulfilled only if a malfunction or a deviation from normal work occurs as well. Wigglesworth (Wigglesworth, 1972) described this model a little differently when replacing the phrase “malfunction” with “error” (no wonder he was a industrial psychologist, therefore preferring the word “error”) (see illustration number 2). He distinguished between an accident without injury that can be cause by an error with no risk factors present and an accident with injury that must involve the presence of a risk factor. Illustration number 2: Wigglesworth’s model of injury What we can derive from this model in order to reduce the number of accidents is 1) to remove the risk factors (a solution that is not practical many times) or 2) preventing errors and malfunctions during the work process. This basic model is included in the more complex models presented next. Occupational hygiene model The occupational hygiene model uses the term of exposure to environmental risk factors. The human is exposed to

harmful substances which are released to the air, and that is how he is injured (see illustration number 3). Illustration number 3: The occupational hygiene model There are six components in the occupational hygiene model:

• Source: the source has a potential to release harmful substances into the environment. The most efficient way to prevention an injury is to replace the current source with a less dangerous

source, or changing the process in a way that the source is less likely to release harmful substances (for example, working with standard pressure and temperature).

• Emission: a substance emitted from the source, such as smoke, that has the potential to cause harm. Preventing an injury in this stage includes using means for preventing the harmful substance from being released into the air by using special devises for that purpose such as fume hoods, suction devises etc.

• Transmission: the channel by which the harmful substance reaches the receiver in the working environment. Prevention in this stage can include building physical barriers, increasing the distance between the worker and the source and working in a ventilated work place.

• Absorption: the entrance of the harmful substance in the receivers’ body by means of breathing, injection etc. Prevention in this stage can include proper clothing and safety equipment, but also by using substances that cannot penetrate the human body (for example, using a weak beta radiation that cannot penetrate the clothes and skin).

• Receiver: usually the meaning is the human that absorbs the substance. Prevention in this stage could be minimizing the time of exposure to the hazard: organizing the work in such a way that a minimum of workers will be present when the hazardous substance is released, changing positions between workers etc.

• Result: controlling the possible outcome in two aspects: early detection of symptoms indicating an over-exposure (the worker should immediately stop the exposure), and medical care and first aid to decrease the effect of the exposure on the workers health.

The “energy” model This model, which underlies many other more complex theories, defines the accident as an uncontrolled energy passage through a man or equipment (see illustration number 4). Illustration number 4: Johnsons' energy model The energy model focuses on the energy source which releases energy in the direction of the human. When there are no barriers between the source and the human an injury can occur. The energy could be one of many types such as physical, chemical, biological, electrical, kinetic energy etc. Barriers that can prevent the energy from reaching the human being are a major part of this model since they can prevent the injury. This model suggests four ways to prevent an injury:

Accident

Risk factor

Malfunction

Event Ri

Injury Risk

Error

Energy source

Human →Energy passage

Managerial Challenges of the Contemporary Society, vol. 7 no. 1

121

• Removing the source of energy (removing the risk factor).

• Blocking the energy source and by that preventing the energy from spreading in the work place (building barriers, fences etc).

• Separating the human from the energy source (physical separation such as a barrier or time based separation meaning preventing humans from being in the energy path when it is released from the energy source).

• Protecting the human workers by proper safety equipment which prevents the hazard source from penetrating.

The “change” model Work accidents are often the result of changes in the work method or in the working crew. A technique called change analysis, which is an accepted technique in investigating accidents in the chemistry and fuel industry, tries to pin- point the changes that occurred in the working zone near the time of the accident. This model assumes that any accident is caused by a change in one of the working processes or due to a new circumstance. Therefore, in order to understand the causes of the accident one must investigate and characterize those changes (see illustration number 5).

Illustration number 5: The change model Based on this model, the researchers Kepner and Tregoe (Kepner and Tregoe, 1981) developed a six step technique to investigate the causes of accidents. This technique is particularly suitable for accidents where the causes for the occurrence are unclear (as seen in illustration number 6).

Illustration number 6: Ferry's' change analysis technique This technique can be used not only for understanding the critical event but also in order to identify the indirect causes. In fact, this model is used also to identify system related causes and management causes but due to the

techniques simplicity and implications on other models, I chose to present it in this section of basic models for accidents. Bird and Loftus domino theory Bird and Loftus (Bird and Loftus, 1976) suggested an improved domino theory which includes the responsibility of the management in the event of an accident (see illustration 7).

Illustration number 7: Bird and Loftus domino theory The five "M" model This Model discusses the interactions between the following factors: Man, Machine, Media, Management, and Mission (see illustration number 8). In this illustration it is clear to see that man, machine and media overlap significantly and are influenced by the standards and procedures that management creates in order to accomplish the mission. The system as a whole must be analyzed in order to apply risk controls.

Illustration number 8: The five "M" model While deriving from studies in the field, it is apparent that "man" is the source of the greatest amount of risk, but management is considered the controlling factor in mission success or failure and is cited in 80 % of reported mishaps by military safety centers and the National Safety Council. This is why keeping supervisors involved is a concept of high importance to the success of risk controlling. Supervisors know the elaborate procedures of risk management, and they usually have the power to effect change when needed. They can assure that risk controls are mission supportive because they usually have the experience to see and reconcile risk costs and benefits. In

Managerial Challenges of the Contemporary Society, vol. 7 no. 1

122

emergency operations, they often have to manage risk themselves. An important comment regarding this point is to keep in mind that the risk management must be mission- supportive. There is no use in adding more bureaucracy and wasting working hours if this does not reduce the mishaps. Assuring that risk management always validates the mission is a key concept. Target optimum mission risk rather than minimum risk, because sometimes not taking a risk is more harmful to the success of the mission. You also need to involve operators while planning risk controls to ensure that the controls are compatible Six steps for operational risk management This six step operational risk management plan is an effective way to detect the risks and controls involved in the procedure at hand. This method guarantees to take into account the different aspects of risk factors which are present in any procedure. In addition it helps prioritize the issues at hand in order to organize the work. It is essential to thoroughly investigate each step of the six steps separately and then as a whole. In the case of serious lack of time, all stages must still be addressed, even if done briefly. This will prevent a situation where only the most obvious risks are taken into account, while neglecting other risk factors that are less obvious.

1. Identifying the hazards In order to identify a hazard, you must first analyze the mission for which you are performing the operational risk management assessment, and then catalog the possible hazards associated with each event of the mission, along with their causes. • Mission or task Analysis: The Hazards involved in the

mission events should be organized either chronologically or in order of importance. This will reduce the chances of forgetting any segment or event of your mission.

• Identify Possible Hazards: The specific event under analysis should be focused on and your list should be focused to the "big picture" hazards rather than every little difficulty that could occur.

• Identify Related Causes: Knowing the root cause helps you devise controls that actually manage the amount of risk associated with the hazard. Some hazards may have multiple causes; you should use the root cause. To determine the root cause, choose the cause that is the first link in the chain of events leading to mission degradation, personnel injury or death, or property damage.

2. Assessing the risk This risk assessing should be done for each hazard. Risks are the probability of an event occurring, the severity of the outcome, and the level of exposure of personnel or resources to that event (see illustration number 9). Risk assessment is a three-part process of evaluating the amount of risk associated with each hazard or undesired event. First consider the level of exposure as the number of personnel or resources affected by a given event, or, over time, by repeated events.

• Estimate the level of severity of the hazard. Hazard severity is ranked in qualitative terms and can be assessed with the following standard categories: o Catastrophic (complete mission failure,

death, or loss of the system). o Critical (major mission degradation, severe

injury, occupational illness or major system damage).

o Moderate (minor mission degradation, injury, minor occupational illness or minor system damage).

o Negligible (less than minor mission degradation, injury, occupational illness, or minor system damage).

• Estimate the probability of the hazard. Express the level of probability descriptively by using the following levels:

o Frequent - occurs often. o Likely - occurs regularly. o Occasional - will occur. o Seldom - may occur. o Unlikely - rarely occurs.

• Express the risk level of a hazard. Use the risk matrix shown below to determine the risk.

Illustration number 9: Assessing the risk- risk matrix

3. Analyzing risk control measures Risk controls are designed to change risk by lowering the probability of occurrence and/or decreasing the severity of a risk. To analyze risk control measures, you must first identify the control options available to you, then determine their effects on the risk level, and finally prioritize the control measures. You can use several resources in helping you determine control measures: devise control measures yourself. Using your experience and a little imagination, you can create ideas for control measures. For example, if the mission involves digging a trench in a potentially high-traffic area, you could place barriers or signs to re-route the traffic or do the work on weekends when traffic would be minimal. You can also select from a list of Macro Control Options that help minimize risk directly. These macro control options include: rejecting the risk entirely, avoiding a task, delaying an event, transferring responsibility for an event, spreading the work around, and compensation by redundancy. Further control measures can include engineer and design to better suit your needs, guard, improve task design, limit

Managerial Challenges of the Contemporary Society, vol. 7 no. 1

123

exposure, selection of personnel, train and educate, warn the humans around the work place, and motivate. Once you have determined the effectiveness of your control measures, rank them starting with the controls that have the greatest effect on severity and probability. Even control measures with only a small effect on risk level can be worth implementing if the cost and resources imperative to do so are low. Performing an opportunity assessment and a cost versus benefit analysis will assist you in prioritizing control measures. In some cases, computer modeling may also be available.

4. Making risk control decisions

Before you start making risk control decisions, keep in mind two important guidelines. First, make decisions at the right time. It is important to review the mission and identify the right time for risk decisions. Make decisions as late as possible to allow more time for collecting and considering hazards and associated risks. Don't wait too long, though, or decisions won't be effectively integrated into the overall mission. Second, make risk control decisions at the right level. That level is the one that can best judge the full range of issues involved. It is also relevant to keep the person who would take the responsibility if the mission does not succeed or even partly fail. The first action in making control decisions is selecting which risk controls to use. The key word here is frugality. If you can control mission risk to an acceptable level by implementing only one control measure rather than by implementing several smaller measures, you would choose the single measure. Although a single problem could have multiple solutions which would give the desired effect, you should strive to pick one since the addition of the others will only cost more time and money. The goal is not the least level of risk; it is the best level of risk for the total mission. Once you have chosen the best mix of control measures it is time for the big decision. Analyze the overall level of risk for the mission with the selected controls in place. Decide if the benefits of the mission outweigh the reduced level of risk or if the risk level is still too high for the benefits that would be gained from performing the mission. Be sure to document the risk decision analysis for future reference.

5. Implementing risk controls

After you have decided what controls to implement, make an implementation plan. For each control you must decide and elaborate on a few matters. First, you must make the implementation clear; all workers who have a part in it should be fully aware of their parts. Second, you must establish accountability; decide who is responsible for each action, who has to report what and to whom etc. Third thing you must see to is to provide support at all levels. As you design the plan for risk control implementation, keep two things in mind to assist in ensuring success. First, stay in line with the organizational culture. For example, if the unit normally uses a much decentralized approach, don't make a plan that requires strict centralized control of every step. Personnel will resent it. Second, ensure a positive reception by designing user ownership into the plan. The best way to do this is to make sure that the users

themselves develop a significant percentage of the risk controls. The seven most common reasons why implementation plans fail are elaborated below. The best way to avoid them is to keep the personnel impinged by control in the loop. Continuously assess your controls for these problems:

• Wrong control for the problem- you should always check if this solution is really the best one.

• Too costly- the control can cost more than the end profit or take a major part of it.

• Disliked by the operators- this situation can cause interference with their work.

• Disliked by the leaders- this situation can cause a bad atmosphere and affect the work.

• Misunderstood- the control can be poorly operated.

• Overmatched by other priorities. • Not measured until it's too late- this way it is hard

to assess its effectiveness. 6. Supervising and reviewing

The sixth and final step of the operational risk management process involves determining the actual effectiveness of risk controls throughout the operation. This is the bottom line in checking whether the measures taken are worthwhile and are there any improvements that need to be implemented. There are three actions required for successful completion of this step. The first step is to supervise the implementation. The second is to review the cost vs. benefit balance and the third is to ask for feedback on the original plan. Supervision of risk control implementation enables you to monitor the effectiveness of controls and make adjustments as warranted. When operational risk management is properly integrated, supervision of risk controls is exactly the same as supervision of any leadership action. The inspection of risk controls focuses on costs in a couple of ways. First, you are encouraged to analyze costs to see if they are in line with expectations. There should be a congruency between the original plan and the costs in practice. If there is a large difference the plan should be inspected and re-examined. Second, you are advised to conduct a cost vs. benefit review to see if the benefits in risk reduction are greater than the costs of the control measure. If the change is nonexistent or just minor, then the control is not effective and should be discontinued. The feedback segment of the "Supervise and Review" step has a threefold purpose. • Informs all involved personnel about the progress of

the risk control implementation to retain co- ownership.

• Compares the planned schedule of implementation to the actual rate and make adjustments as necessary to keep on track.

• Provides a means to directly measure the degree of change in the physical condition or personnel behavior in the organization.

Managerial Challenges of the Contemporary Society, vol. 7 no. 1

124

3. Conclusions An accident in the workplace is a malfunction. It is a malfunction in terms of the human behaviour, of the technology, the work environment and in terms of the management in charge. The malfunctions in term of the management can refer to a lack of proper planning, lack of safety guidance for the workers, lack of supervision, and negligence in identifying hazards or finding proper solutions for known hazards. What is in common for all of these malfunctions is related to the management style. The management’s main goal is to organize and coordinate between the workers, the environment, and the technology. That is why it is imperative for a manager to understand and use risk management in every step of the working process regarding his workers. Questions he must ask himself are is the worker qualified to undertake the task and does he know what is expected of him? Are the machines intact? Is the working environment safe and pleasant (for instance is there enough light)? And who is supervising the worker? References [1] Bird, F.E, & Loftus, R.G. (1976). Loss control management. Loganville, Georgia: Institute Press. [2] "Committee Draft of ISO 31000 Risk management" (2007). International Organization for Standardization. [3] Heinrich, H. W. (1941). Industrial accident prevention (2nd edition). New York: McGraw Hill. [4] Heinrich, H. W., Petersen, D., & Roos, N. (1980). Industrial accident prevention: A safety management approach (5th edition). New York: McGraw Hill. [5] Hubbard, Douglas (2009). The Failure of Risk Management: Why It's Broken and How to Fix It. John Wiley & Sons. p. 46. [6] ISO/DIS 31000 (2009). Risk management — Principles and guidelines on implementation. International Organization for Standardization. [7] ISO/IEC Guide 73:2009 (2009). Risk management — Vocabulary. International Organization for Standardization. [8] Ferry, T. S. (1988). Modern accident investigation and analysis (2nd ed.). New York: John Wiley and Sons. [9] Flyvbjerg, B. & Budzier, A. (2011). Why Your IT Project May Be Riskier Than You Think, Harvard Business Review, vol. 89 (9), 601-603. [10] Fraser, J., Simkins, B. J. & Del Bel Belluz, D. (2011). Operational Risk Management in Enterprise Risk Management: John Wiley & Sons inc. [11] Johnson, W. G. (1980). MORT: Safety assurance systems. New York: Marcel Dekker. [12] Kepner, C. H., & Tregoc, B. B. (1981). The New Rational Manager. New York: McGraw-Hill. [13] Wigglesworth, E.C. (1972). A teaching model of injury causation and a guide for selecting countermeasures. Occupational Psychology, 46, 69-78.

Copyright of Managerial Challenges of the Contemporary Society is the property of Risoprint Publishing House and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use.