A dossier assignment

32 PSJ PROFESSIONAL SAFETY DECEMBER 2020 assp.org

RISK MANAGEMENT Peer-Reviewed

KEY TAKEAWAYS •The concept of using the risk management process is fundamental to assessing and managing all types of risk, including those created by pandemics. It is a universal approach designed to better under- stand risk and reduce uncertainty. •This article presents the use of risk management and risk as- sessment from a business continuity standpoint on the impacts of COVID-19. The authors provide a risk-based perspective on the pan- demic and its overall effects as it concerns OSH professionals and their organizations. •This article presents the use of risk management and risk as- sessment from a business continuity standpoint on the impacts of COVID-19. The authors provide a risk-based perspective on the pan- demic and its overall effects as it concerns OSH professionals and their organizations. •The authors present a use of methods that incorporate risk sum- mation to understand and communicate whole-system risk.

UUNCERTAINTY AND FEAR OF THE UNKNOWN are the real ene-mies. Investment strategist Jim Paulsen (as cited in Minkoff, 2020) described it this way: “Although the contemporary crisis is loaded with bad news, this has not been its primary problem. It is the ‘unknown.’ Give me bad news any day over complete uncertainty.” Paulsen’s point is that if we know what we are dealing with, we are better prepared to manage it, whether or not it is bad news.

From an enterprise and strategic perspective, “risk ” is defined as “the effect of uncertainty on objectives” (ANSI/ ASSP/ISO, 2018). When an organization is faced with signif- icant uncertainty (or undefined risk), it is negatively affected in its ability to make decisions and successfully achieve its business objectives.

On a more tactical and operational level, risk is known as the likelihood of something occurring and the severity of its con- sequences. Hazard and operational risks present only negative effects such as harm to people and the environment, damage or loss of assets and property, interruption of business operations, and loss of income, market share and reputation, to mention a few. There are also those types of risk that can present oppor- tunities such as business ventures, investments, acquisitions, expansions, and other financial and strategic risks that organi- zations decide to pursue and manage.

The risk management process outlined in ISO 31000 and 31010 (Figure 1) provides a road map to anticipating, identify- ing, assessing and managing risk. In this article, the authors describe this process to examine how it can be applied to pan- demic situations such as COVID-19.

Uncertainty Uncertainty, strongly linked to probability, can occur in

several different ways including a lack of relevant knowledge of the system (epistemic uncertainty), a random, unpredict- able nature surrounding the system (aleatory uncertainty), a vagueness or ambiguity inherent in spoken languages (lin- guistic uncertainty), and uncertainty associated with value systems, professional judgment, company values and societal norms (decision uncertainty).

There will always be some degree of uncertainty and risk in everything we do. Organizations and individuals are now facing such uncertainty surrounding the COVID-19 pan- demic. The actual impact of the pandemic goes far beyond the health risks to people. As we have witnessed, the effects of this pandemic have global implications that are unprece- dented. Globally, businesses have been forced to shutter their operations leaving only those manufacturers, service provid- ers and transportation operations that fulfill essential needs to the public. The surge of COVID-19 patients has caused an overload to our healthcare systems, with some countries in serious uncertain conditions. The economy has suffered as indicated by the financial markets and their reactions to this event, which cascades into other concerns such as job secu- rity, ability to pay mortgages and bills, and healthcare costs. The shortage of PPE such as N95 face masks and medical equipment such as ventilators adds to the global stress level. With many workplaces requiring employees to work from home using personal computers and company-owned lap- tops, the exposure to cyber threats such as phishing emails, ransomware and malware infections increases. Psycholog- ical stress from significant change in everyday life, social isolation and uncertainty about the future is also a risk that organizations must recognize and manage.

The Risk Continuum Risk is dynamic and can be viewed as a continuum. It chang-

es with the emergence of new conditions, changes in variables, risk drivers and exposures, degree of uncertainty, and effects of applied risk treatments. A continuum can be defined as a coherent whole characterized as a collection, sequence, or progression of values or elements varying by minute degrees. For example, the state of water within a range of temperatures from freezing to boiling represents a continuum; water is a solid when frozen, a liquid when at room temperature and a gas when boiled. In risk management, risk can be viewed as being in a continuum depending upon its point in the risk manage- ment cycle. For this reason, risk management must not only in-

With COVID-19 & Its Impact By Bruce K. Lyon and Georgi Popov

THE ROLE OF RISK

IG O

R IS

S/ IS

TO C

K /G

ET TY

IM A

G ES

P LU

S

assp.org DECEMBER 2020 PROFESSIONAL SAFETY PSJ 33

clude managing initial risks that have been identified, assessed and treated, but also anticipate potential unknown risk, detect emerging and developing risks, identify inherent risk and as- sess initial risk, as well as previously treated risks, residual risks and possible secondary risks created by risk treatments. This continuous and dynamic process of risk is expressed in Figure 2 (p. 34) as the risk continuum.

Risk is derived from its risk source (e.g., hazards, operations, financial and strategic) and influenced by risk drivers. Risk treatments are designed to maintain control of the risk and pre- vent exposure to assets or objectives. When a loss of control oc- curs from a trigger or cause, exposure to the risk source results in an incident or event that results in consequences and effects on the objectives. A simplified relationship of elements within the risk pathway is represented in Figure 3 (p. 34). Although the illustration is linear, risk is often multidimensional and must be considered as such.

Assessing Pandemic-Level Risk: COVID-19 R isk is dy na mic and continuously evolv ing w it h

changing conditions, risk drivers, risk treatments and ot her variables. The risk pat hway for a pandemic such as COVID-19 begins w it h t he risk source: a new v irus (Fig- ure 3, p. 34). In t his case, t he risk drivers (conditions t hat inf luence t he risk source) may include globa l travel, socia l interactions, unk now n vectors and env ironmenta l con- ditions. Exposures to t he risk source might include t he orga nization’s employees a nd key personnel, its suppliers, customers a nd contractors, possibly hea lt hcare prov id- ers a nd waste ma nagement. At t his point, a trigger event causes t he incident to occur such as loss of containment of infected persons unk now ingly spreading t he infection. Once t he spread reaches pandemic levels, t he consequenc- es begin to be felt, including impacts on employees, op- erations, supply chains, f ina ncia l conditions a nd overa l l sur v ivabi lit y of t he organization.

Before the event occurs as part of business continuity plan- ning, the organization must establish its own risk criteria and context for managing risk. Its purpose is to customize the risk management process to the organization, enabling effective risk assessment and appropriate risk treatment. This involves defining the purpose and scope of the process, understanding the context, planning the approach to be taken and defining the criteria for evaluation.

Risk criteria are the basis for risk-based decision-making and action taken. Specifically, they are the criteria to determine 1. how risk is to be analyzed; 2. outputs required from the analy- sis; and 3. the most appropriate risk management techniques to be used. Risk criteria are the defined reference points and mea- surements used to evaluate and compare against the risk levels determined in the risk analysis. To help demonstrate how the risk management process can be applied to a pandemic scenar- io, the following case study is provided.

Case Study A U.S. company producing respirators and other supplies

was concerned about rising production costs. As a result, the company considered outsourcing 50% of its production to a manufacturer in China. As part of the arrangement, the organization would need to send a team overseas to train the personnel in the Chinese facility. In light of the COVID-19 pandemic, the organization decided to send a team of experienced risk assessors to perform a risk assess- ment using established risk criteria including a 5x5 risk matrix (Figure 4, p. 35).

t on Pandemics

FIGURE 1 THE RISK MANAGEMENT PROCESS

Scope, con- text, criteria

Risk assessment

Risk treatment

Recording and reporting

C o

m m

u n

ic at

io n

a n

d c

o n

su lt

at io

n

M o

n it

o ri

n g

a n

d r

ev ie

w

Risk identification

Risk analysis

Risk evaluation

Note. Adapted from “Risk management: Guidelines (ISO 31000:2018),” by ISO, 2018.

K MANAGEMENT

34 PSJ PROFESSIONAL SAFETY DECEMBER 2020 assp.org

Considering the complexity and nature of the risks, the team reviewed the methods found in ISO 31010 and ASSP’s TR- 31010-2020 technical report, “Risk Management—Techniques for Safety Practitioners” (Figure 5) and decided upon a modi- fied what-if method called structured what-if risk assessment (SWIFRA). SWIFRA expands the “what-if ” questions to in- clude “how” and “why,” as well as incorporates risk estimations, evaluation and recommended risk treatments (Lyon & Popov, 2020c). A portion of the resulting risk assessment is shown in Figure 6 (p. 36).

One risk-reduction measure identified by the team was daily disinfection of surfaces. Because of its low cost and

ready availability, bleach was initially suggested by the purchasing department as the disinfectant solution. Un- fortunately, the purchasing manager did not consult with the production manager and was not aware that bleach may damage sensitive equipment. Also, under certain conditions bleach can create chlorine gas.

Other OSH risks were considered. A common complaint during the winter months was minor respirator y irritation due to low relative humidity. However, such minor issues were not considered a priority since relative humidity and temperature are not regulated and there are no OSHA stan- dards related to indoor off ice temperature. Note: OSHA

FIGURE 2 THE RISK CONTINUUM

Anticipate Detect Identify Assess

Identify Avoid

Treat Estimate

Unknown risk

Emerging risk

Inherent risk

Initial risk

Residual risk

Future state risk

Secondary risk

Note. Adapted from “COVID-19: The Role of the Risk Management Process and Its Impact on Pandemics,” by B.K. Lyon and G. Popov, 2020a.

FIGURE 3 THE RISK PATHWAY OF COVID-19

Risk source: New virus

Global travel, environmental

conditions, social interactions, un-

known vectors

Employees/key personnel, suppliers, customers, contractors,

healthcare/deathcare, waste management

Loss of containment, infected parties,

spreading infection Pandemic

Impacts to people, business objectives,

supply chain, financial,

overall survivability

Risk drivers Exposure Trigger

Incident

ConsequencesConsequences

Note. Adapted from “COVID-19: The role of the risk management process and Its impact on pandemics,” by B.K. Lyon and G. Popov, 2020a.

assp.org DECEMBER 2020 PROFESSIONAL SAFETY PSJ 35

(n.d.) recommends that employers maintain workplace temperatures in the range of 68 to 76 °F and humidity control in the range of 20% to 60%. According to an OSHA (2003) inter- pretation letter, “off ice temperature and humidity conditions are generally a matter of human comfort rather than hazards that could cause death or seri- ous physical harm. OSHA cannot cite the general duty clause for personal discomfort.” Controls for worker ex- posure inside the facility concerning infectious diseases were evaluated using a simplif ied layers of protection analysis (Figure 7, p. 36).

A brainstorming session was conducted by a cross-functional team to consider the additive effects of lower-level risks. It was determined that using bleach presented a secondary risk since chlorine affects the respiratory system, weakening humans’ natural defenses. In addition, low humid- ity (relative humidity = 11%) can dry out the mucus that normally coats the nose and airways, making it easier for the virus to enter the body and cause infection. Considering these additive effects, the team estimated that the combined risk to be “very high” (Figure 8, p. 37). To com- municate the “big picture” to upper-level management, the team presented its find- ings in a striped bow-tie risk assessment (Figure 9, p. 37).

Managing the Risks of a Pandemic As demonstrated in the case study, the

potential effect of combined or whole-sys-

FIGURE 4 RISK MATRIX

1 2 3 4 5 Very

unlikely Unlikely Possible Likely

Very likely

5 Death or permanent total

disability Catastrophic

damage Significant

impact 5 10 15 20 25

4 Permanent partial disability; hospitalizations of three or

more people Severe damage

Significant but reversible impact

4 8 12 16 20

3 Injury or occupational illness resulting in one or more days

away from work

Significant damage

Moderate reversible impact

3 6 9 12 15

2 Injury or occupational illness not resulting in lost workdays

Moderate damage

Minimal impact 2 4 6 8 10

1 First aid only; no injuries or

illnesses Light damage No impact 1 2 3 4 5

Very high risk = 15 or greater; high risk = 9 to 14; moderate risk = 5 to 8; low risk = 1 to 4

Incident outcomes

Severity rating

Health effects (people) Property damage

Environmental impact

Likelihood of occurrence

FIGURE 5 RISK MANAGEMENT PROCESS ASSOCIATED METHODS

Scope, con- text, criteria

Risk assessment

Risk treatment

Recording and reporting

C o

m m

u n

ic at

io n

a n

d c

o n

su lt

at io

n

M o

n it

o ri

n g

a n

d re

vi ew

Communication •Risk matrix/heat map •Radar/spider chart •SWOT analysis •Risk register •Risk hierarchy •Bow tie diagram •Striped bow tie

Risk analysis

Risk evaluation

Context •Risk criteria •Risk scoring system •ALARP •Risk matrix •Brainstorming •Delphi technique •Nominal group

Risk Assessment •FMEA/FMECA •HACCP •LOPA/LOCA •SWIFRA •Striped bow tie •Reliability assessment •Human reliability analysis •Quantitative risk as- sessment •Major incident risk •Exposure assessment •Ergonomic risk assess- ment

Treatment •Hierarchy of controls •Cost/benefit analysis •Financial benefits •Non-financial benefits •Design safety review •MOC •Barrier analysis •LOPA/LOCA

Identification •Brainstorming •Pareto analysis •Checklists •Multiple why •Interviews •Surveys •Delphi technique •Nominal group •PHA •HAZID/RISKID •What-if/SWIFT •HAZOP •Design safety review •Fishbone analysis •Cindynic approach •Causal mapping

Analysis •PHA •HAZOP •Scenario analysis •Fault tree analysis •Event tree analysis •Bow tie analysis •BIA •Markov analysis •Cross impact analysis •MCDA

Evaluation •Risk indices •Risk matrices •ALARP/SFAIRP •Monte Carlo

Monitor & Record •Risk-based audits •KPIs •KRIs •Risk register

Risk identification

Note. Reprinted from “Managing Risk Through Layers of Control,” by B.K. Lyon and G. Popov, 2020, Professional Safety, 65(4), p. 30.

36 PSJ PROFESSIONAL SAFETY DECEMBER 2020 assp.org

tem risk is often greater than its individual risks. If risks are an- alyzed individually without considering additive (summation) effects, the whole-system risk can be underestimated.

A single control is rarely adequate. To effectively reduce risk, both preventive and mitigative measures must often be used (Lyon & Popov, 2020b). Using a hierarchy of risk treatment model such as the one shown in Figure 10 (p. 38), layers of control should be selected and applied to effectively reduce and maintain risk at an acceptable level.

In terms of a pandemic, layers of multiple control meth- ods are necessary to adequately reduce the risk. This can be illustrated using the risk pathway model for the COVID-19

scenario presented in Figure 11 (p. 39). In the model, the risk control strategies are applied in layers to both 1. prevent exposure; and 2. mitigate the impact. The layers of control for the COVID-19 pan- demic scenario in Figure 11 (p. 39) are briefly explained as follows:

1. Consider avoidance and elimi- nation strategies such as eliminating travel to hot zones and temporarily relocating operations.

2. Substitution may be possible by substi- tuting or replacing the exposure that occurs in office environments with remote or isolat- ed work, use of teleconferencing for in-per- son meetings, and use of less toxic cleaning and disinfecting chemicals. In addition, the separation of critical personnel may be nec- essary to ensure business continuity.

3. Incorporate engineering controls to reduce the ef- fects on the business from a pandemic such as COVID-19. Engineering controls might include robust informational technology systems to accommodate relocated workers and protect the organization’s data and intellectual prop- erty (e.g., VPN, remote access to office files, laptops, an- timalware). For healthcare and other essential operations that remain open, good ventilation systems equipped with high-efficiency particulate air filtering and 50% relative hu- midity, use of ultraviolet light systems to disinfect surfaces, and isolation of infected patients in controlled environments from the general population may be needed.

FIGURE 6 STRUCTURED WHAT-IF RISK ASSESSMENT (SWIFRA)

Note. Reprinted from “COVID-19: The role of the risk management process and Its impact on pandemics,” by B.K. Lyon and G. Popov, 2020a.

FIGURE 7 LAYERS OF PROTECTION ANALYSIS OF COVID-19

Note. Adapted from “COVID-19: The role of the risk management process and Its impact on pandemics,” by B.K. Lyon and G. Popov, 2020a.

assp.org DECEMBER 2020 PROFESSIONAL SAFETY PSJ 37

4. Consider administrative measures and procedures such as limiting public exposure, physical distancing, training in prop- er hygiene, use of thermal imaging cameras to detect elevated body temperatures and frequent cleaning of surfaces.

5. PPE such as N95 face masks, eye protection and imperme- able gloves for those who have a potential of exposure to infec- tion is required.

From a mitigative standpoint, plans developed well in advance of an event should be activated during the pan- demic to reduce the impact of consequences. These include business continuity plans, communication and employee assistance plans, crisis management plans, and access to emergency funds. These layers of control work in concert to reduce the overall impact to the organization and help ensure resiliency.

These layers of control can be entered into the layers of con- trol analysis, which includes a risk assessment of preventive and mitigative risk reduction. An example is presented in Figure 12.

With this information, the risk management team can provide more details in their risk treatment plans. For ex- ample, by increasing the relative humidity, a reduction of

respiratory system dryness and irritation is achieved leading to less coughing in the workplace. Nasal systems and mu- cous membranes are more sensitive to infections at very low relative humidity of 10% to 20% and, therefore, additional humidification in winter seasons is sometimes suggested. In fact, recent studies state that low humidity “prevented cilia, which are hairlike structures in airways cells, from re- moving viral particles and mucus. It also reduced the ability of airway cells to repair damage caused by the virus in the lungs” (Yale University, 2019).

Lessons can also be learned from environmental remediation companies regarding the substitution of bleach with less toxic and equally or more effective disinfectants. In fact, EPA-regis- tered products often used in mold remediation are proven to be effective against human coronaviruses. By substituting bleach with EPA-registered fungicides or disinfectants, the potential for chlorine exposure is eliminated, leading to less respiratory irritation and less coughing.

Better f iltration, physical distancing, separation of crit- ical personnel and operations using two shifts instead of one, and PPE should be considered. Having two shifts will

FIGURE 8 LAYERS OF PROTECTION RISK SUMMATION FOR COVID-19

Note. Adapted from “COVID-19: The role of the risk management process and Its impact on pandemics,” by B.K. Lyon and G. Popov, 2020a.

FIGURE 9 STRIPED BOW-TIE RISK ASSESSMENT CURRENT STATE

Note. Adapted from “COVID-19: The role of the risk management process and Its impact on pandemics,” by B.K. Lyon and G. Popov, 2020a.

38 PSJ PROFESSIONAL SAFETY DECEMBER 2020 assp.org

enable suff icient distance between workers (having more space) and business continuity. If one shift becomes in- fected and quarantined, the other can continue to produce critical supplies.

Infectious Disease Preparedness & Response The risk of an infectious disease outbrea k, epidemic

or pa ndemic in t he workplace must be ma naged so t hat a n orga nization ca n continue to protect its employees, operate sa fely a nd achieve its objectives. This requires t hat t he orga nization develop a n infectious disease pre- paredness a nd response plan a head of time w it h interna l trigger points for implementation and response. Such a pla n shou ld be developed in accorda nce w it h g uida nce from CDC a nd OSHA as wel l as state a nd loca l agencies, medica l exper ts and key personnel (e.g., lega l, human resources, insurance, customers, distributors, suppliers, ot her key sta keholders). In addition, t he plan shou ld be integrated into t he organization’s safet y and hea lt h man- agement system, and business continuit y, crisis manage- ment and communication plans.

Key elements in an infectious disease preparedness and response plan might include roles and responsibilities, exposure assessment, infectious disease task force, safety protocols, exposure response actions, recordkeeping and reporting, and plan review.

Roles & Responsibilities Both managers and employees have important roles in

providing and maintaining a safe workplace during infec- tious disease outbreaks. A breakdown of the responsibilities for leadership and employees concerning infectious disease prevention, communication and action plans should be de- f ined and effectively communicated.

Exposure Assessment OSHA (2020) outlines steps em-

ployers should take to protect the safety and health of their workforces including the development of an infectious disease preparedness and response plan. The plan should con- sider and address the level of risk as- sociated with various work sites and tasks workers perform by the orga- nization (Figure 13, p. 40). The fol- lowing risk category classifications should be used to guide the details of the response plan (OSHA, 2020):

•Ver y high exposure risk groups include healthcare workers (e.g., doctors, nurses, dentists, paramed- ics, emergency medical technicians) performing aerosol-generating pro- cedures (e.g., intubation, cough in- duction procedures, bronchoscopies, some dental procedures and exams, invasive specimen collection) on k nown or suspected COVID-19 pa- tients, and healthcare or laborator y personnel collecting or handling specimens from k nown or suspected COVID-19 patients.

•High exposure risk jobs include healthcare delivery and support staff (e.g., doctors, nurses, hospital staff who must enter patients’ rooms) exposed to known or suspected COVID-19 patients, and medical transport workers moving known or sus- pected COVID-19 patients in enclosed vehicles.

•Medium exposure risk jobs include those that require frequent or close contact (i.e., within 6 ft) with people who may be infected with COVID-19 but who are not known or suspected COVID-19 patients. In areas where the COVID-19 virus has been identified, this may include workers who come in contact with the public, including in schools or re- tail settings.

•Lower exposure risk jobs are those that do not require contact with people known to be or suspected of being in- fected with COVID-19 nor frequent close contact with the general public.

In addition to consideration of workers’ risks, the plan should take into account contingencies that may arise during outbreaks, including:

•increased rates of worker absenteeism •the need for social distancing, staggered work shifts, down-

sizing operations, delivering services remotely and other expo- sure-reducing measures

•options for conducting essential operations with a reduced workforce, including cross-training workers across different jobs to continue operations or deliver surge services

•interrupted supply chains or delayed deliveries

Infectious Disease Task Force Team The plan should establish a cross-functional team responsi-

ble for guiding and overseeing workplace protocols to control the spread of infectious diseases such as COVID-19. The team should include key members from senior management, human resources, legal, facilities, operations, key employees and other

FIGURE 10 HIERARCHY OF RISK TREATMENT MODEL

Note. Reprinted from “Moving Risk Assessment Upstream to the Design Phase,” by B.K. Lyon and G. Popov, 2019, Professional Safety, 64(11), 32.

assp.org DECEMBER 2020 PROFESSIONAL SAFETY PSJ 39

stakeholders. The team should consider and select appropriate control measures to prevent and reduce the risk of infectious disease exposures in the workplace as outlined by OSHA. These options include:

1. avoidance and elimination such as avoiding travel to high- risk areas and eliminating face-to-face meetings

2. substitution of less harmful substances or methods such as replacing chlorine bleach cleaner with an EPA-reg- istered disinfectant and teleconferencing rather than in-person meetings

3. engineering controls such as air filters, increased ventila- tion and physical barriers

4. administrative controls such as requiring sick workers to stay home, minimizing contact among workers by avoiding

face-to-face meetings, discontinuing nonessential travel and creating emergency communication plans

5. safe work practices such as promoting personal hygiene practices (handwashing)

6. PPE such as gloves, face masks, goggles and respiratory protection, when appropriate

Safety & Health Protocols An important part of the plan are formal safety and

health protocols for employees, as well as contractors, cus- tomers and other third parties to be implemented in the event of an outbreak. These protocols should incorporate the layers of control using the hierarchy of risk treatment. Such protocols include general safety and health practices

FIGURE 12 LAYERS OF CONTROL ANALYSIS OF COVID-19

Note. Adapted from “COVID-19: The role of the risk management process and Its impact on pandemics,” by B.K. Lyon and G. Popov, 2020a.

FIGURE 11 THE RISK PATHWAY OF COVID-19

Risk source:

New virus

Global travel, environmental

conditions, social interactions, un-

known vectors

Employees/key personnel, suppliers, customers, contractors,

healthcare/deathcare, waste management

Loss of containment, infected parties,

spreading infection Pandemic

Impacts to people, business objectives,

supply chain, financial,

overall survivability

Trigger Incident

Avoid/elim- inate travel

to hot zones, relocate oper-

ations

Substitute re- mote working, teleconferenc- ing, less toxic disinfectants,

segregation of key personnel

Robust IT sys- tem, isolation of infected, HEPA

ventilation, 50% humidity, UV

lights, physical distancing, in- frared imaging

temperature

Hygiene, hand wash-

ing

Self-quaran- tine, PPE

Business continuity plans,

employee assistance,

communication, emergency funds

Note. Adapted from “COVID-19: The role of the risk management process and Its impact on pandemics,” by B.K. Lyon and G. Popov, 2020a.

Risk drivers

Exposure

ConsequencesConsequences

40 PSJ PROFESSIONAL SAFETY DECEMBER 2020 assp.org

(as outlined by CDC, OSHA and this article); policies for avoiding exposure (e.g., travel bans, remote work); sani- tation, disinfection and hygiene; facility and workstation physical modif ications and engineering controls; admin- istrative policies; PPE supplies and use; policies for man- aging contractors, visitors and third parties; training and monitoring; and other related protocols.

Exposure Response, Recordkeeping & Reporting The plan should outline guidance for how the organization

will respond to employee exposure and infection, and establish protocols for quarantine, medical testing and return-to-work procedures. Recording and reporting work-related exposures should be included in the plan, adhering to federal, state and local requirements.

Conclusion Because the uncertainty from a global pandemic can sig-

nificantly affect organizations, it is critical to be prepared for such risks in advance. As part of an organization’s busi- ness continuity planning, risk assessment and risk man- agement methods should be used to address pandemic level risks such as COVID-19.

Rarely is one control met hod adequate in preventing or protecting people, proper t y or env ironment from harm. The layering of controls a nd defenses has been used t hroughout t he years and has proven to be ef fective

in reducing t he risk from mu ltiple t hreats. OSH profes- siona ls shou ld consider t his approach for t he workplace when a na lyzing a nd designing risk reduction measures by including bot h preventive and mitigating controls. Using met hods such as what-if a na lysis, SWIFR A, bow-tie dia- gra ming, a nd layers of control a na lysis to a na lyze control ef fectiveness and estimate risk summation can help OSH professiona ls identif y wea k nesses a nd needs for bui lding additiona l layers of control. PSJ

References ANSI/ASSP/ISO. (2018). Risk management—Guidelines (ANSI/

ASSP/ISO 31000-2018). ANSI/ASSP/ISO/IEC. (2019). Risk management—Risk assessment

techniques (ANSI/ASSP/ISO/IEC 31010-2019). Lyon, B.K. & Popov, G. (2019, May). Risk treatment strategies: Har-

monizing the hierarchy of controls and inherently safer design con- cepts. Professional Safety, 64(5), 34-43.

Lyon, B.K. & Popov, G. (2020a, March). COVID-19: The role of the risk management process and its impact on pandemics [Webinar]. www.assp.org/resources/covid-19/webinars/covid-19-the-role -of-the-risk-management-process-and-its-impact-on-pandemics

Lyon, B.K. & Popov, G. (2020b, April). Managing risk through lay- ers of control. Professional Safety, 65(4), 25-35.

Lyon, B.K. & Popov, G. (2020c, June). The power of what-if: Assess- ing and understanding risk. Professional Safety, 65(6), 36-43.

Minkoff, Y. (2020, March 17). Futures swing between gains and losses in volatile action. Seeking Alpha. https://seekingalpha.com/ news/3552354-futures-swing-gains-and-losses-in-volatile-action

OSHA. (n.d.) Indoor air quality investigation: Recommendations for the employer. www.osha.gov/dts/osta/otm/otm_iii/otm_iii_2 .html#5

OSHA. (2003, Feb. 24). Standard interpretation: OSHA policy on in- door air quality: Office temperature/humidity and environmental to- bacco smoke. www.osha.gov/pls/oshaweb/owadisp.show_document?p _table=interpretations&p_id=24602

OSHA. (2020). Guidance on preparing workplaces for COVID-19 (Publication No. 3990-03-2020). www.osha.gov/Publications/OSHA 3990.pdf

Yale University. (2019). Flu virus’s best friend: Low humidity. ScienceDaily. www.sciencedaily.com/releases/2019/05/190513155635 .htm

FIGURE 13 OSHA’s OCCUPATIONAL RISK PYRAMID FOR COVID-19

Very high

High

Medium

Lower risk (caution)

Note. Adapted from “Guidance on Preparing Workforces for COVID-19 (Publication No. 3990-03-2020),” by OSHA, 2020.

Bruce K. Lyon, P.E., CSP, SMS, ARM, CHMM, is vice president with Hays Cos. He is chair of the ISO 31000 U.S. TAG, vice chair of ANSI/ASSP Z590.3, advisory board chair to University of Central Missouri’s (UCM) Safety Sciences program, and a director of BCSP. Lyon is coauthor of Risk Manage- ment Tools for Safety Professionals and Risk Assessment: A Practical Guide to Assessing Operational Risk. He holds an M.S. in Occupational Safety Man- agement and a B.S. in Industrial Safety from UCM. In 2018, he received the CSP Award of Excellence from BCSP. Lyon is a professional member of ASSP’s Heart of America Chapter, and a member of the Society’s Ergonomics and Risk Management/Insurance practice specialties.

Georgi Popov, Ph.D., CSP, QEP, SMS, ARM, CMC, FAIHA is a pro- fessor in the School of Geoscience, Physics and Safety Sciences at UCM. He is coauthor of Risk Assessment: A Practical Guide for Assessing Operational Risk and Risk Management Tools for Safety Professionals. Popov holds a Ph.D. from the National Scientific Board, an M.S. in Nuclear Physics from Defense University in Bulgaria and a post-graduate certification in environ- mental air quality. He graduated from the U.S. Army Command and General Staff College in Fort Leavenworth, KS. Popov is the chair of ANSI/ASSP Z590.3, vice chair of ISO 31000 U.S. TAG, a professional member of ASSP’s Heart of America Chapter and a member of the Society’s Risk Management/ Insurance Practice Specialty. He received the chapter’s 2015 Safety Profes- sional of the Year (SPY) Award and the 2016 ASSP Region V SPY Award. In 2017, Popov received ASSP’s Outstanding Safety Educator Award.

Because the uncertainty from a global pandemic can significantly

affect organizations, it is critical to be prepared for such risks in advance.

Copyright of Professional Safety is the property of American Society of Safety Engineers and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use.