Risk Assessment Training Course
We all take Risks every day. Like it or not, it’s an essential part of everyday life. Some would say that if you don’t take risks, you can’t expect to achieve anything in life!
On this page we will explore the concept of risk and show you how an understanding of risk can help you to make better decisions, at home,
at play, at work or wherever you may wander!
FREE Risk Assessment Course: Know your risks. Make better decisions.
This mini course is designed to help you make decisions on your risks in a more structured way.
Watch the introduction here!
Why do we need to understand risk?
Now more than ever, we need to be aware of, and understand our risks. Our world is changing and many of those changes affect the risks that we deal with.
Whether directly or indirectly, we’ve all been affected by the rising tide of crime and terrorism.
Climate change is creating an uncertain future. Storms are becoming more intense and more frequent, droughts are getting longer, wildfires are becoming commonplace even in areas that have never experienced them before. The ocean is rising, causing floods, salination of freshwater aquifers and coastal erosion.
Recreational sports continue to place people in higher and higher risk situations.
Technology is changing at an exponential rate. The risk of being made redundant by a growing workforce of robots is real. The risk of traditional industries and even lifestyles being eclipsed by technology is also real.
But it’s not just the hazards that are changing. Modern society has a very different level of risk acceptance than we used to live with. A hundred years ago injuries and even deaths in the workplace were accepted as part of normal business. Not the case now! In fact most countries have laws that require all businesses to identify and reduce all safety and health risks as much as possible.
We used to all happily accept the risk of driving cars without seatbelts and riding bikes without helmets. For most people, that’s not the case now. Kids playgrounds offer a very different set of risk experiences than they did a few decades ago!
Arguably, modern society has removed so many safety risks that people are growing up without practicing an essential life skill-risk taking! Also, our knowledge of hazards is much better now than it ever was, so there really is no excuse for exposing yourself to asbestos poisoning, or going deaf due to noise exposure.
As we get older our approach to risk changes too-partly we get older and wiser, but we also have more and more responsibilities with age. We have responsibilities to our families and friends, colleagues, customers and to ourselves. These growing responsibilities affect our risk acceptance and our methods for evaluating risk.
By understanding our risks, we are then able to make well informed decisions about them.
Risk will always be a constantly moving set of goal posts and it seems likely that uncertainty will dominate the future. But let’s not forget that with every risk there is also an opportunity, or a reward. My goal is to help you to take sensible risks and maximise the rewards!
A history of risk
Risk thinking is instinctive in intelligent organisms, but some people or organisations, do it much better than others.
Here is a brief history of risk to put modern risk thinking into perspective.
The earliest example of structured risk thinking was in the 3rd millennia BC. Ancient Chinese merchants navigating treacherous rivers would distribute their wares over many boats to limit their losses due to any single boat capsizing.
Later, in ancient Greece and the Roman Empire, lenders would estimate the risks of providing loans and compare that to the rewards they would receive in terms of interest. This enterprise eventually gave rise to banks.
In ancient Athens in the 4th century BC the concept of the “maritime loan” was born. This loan covered a merchant ship’s voyage and repayment was cancelled if the ship was lost. Rates for the loans varied according to safe or dangerous times of year and whether the route was deemed to be easy or treacherous. This had an effect similar to modern insurance.
During the 17th Century in London, insurance branched out from the merchant shipping industry to cover life and health insurance in a form that’s familiar to us today.
So the finance and insurance worlds have been practicing risk calculations for a long time and not surprisingly, they have become very good at it!
But it wasn’t until the 1960’s that structured risk thinking was applied to health and safety risk.
The Canadian nuclear industry, aware that they were dealing with highly hazardous materials and processes decided that they needed a more structured method to manage their hazards. By taking into account the severity of consequences of an accident and the likelihood of that event happening, they successfully modified numerical methods of financial risk management to represent health and safety risks. Two decades later after the Piper Alpha disaster where an oil rig in the North Sea caught fire and killed 167 men, the global oil and gas industry followed suit and adopted the risk management process as developed by the Canadian nuclear industry.
Slowly over the decades that followed the use of the risk management process has filtered down through the high hazard industries like mining and construction, to the lower hazard industries and most Countries now have laws that require all businesses to use the risk management process to manage health and safety risks.
Fortunately for us, it’s not rocket science-it’s actually very simple, and with a small amount of guidance everyone can benefit from using a bit of structure when making decisions about risk.
Hazard vs. risk
We are surrounded by risks and we’re also surrounded by hazards, so what’s the difference?
Very simply, a hazard is any item that has the potential to cause harm. Whereas, a risk issue is the actual harm that the hazard could cause. For example, in this picture we are looking at a pure hazard. It’s a tiger, showing us its very capable looking teeth. But since there aren’t any people in the picture there really isn’t any risk. Apart from maybe a risk of harm to the other tiger.
In this picture we are looking at a serious risk issue, where this small girl is placing herself at risk of being eaten alive. And then in this picture, what has happened to the hazard and the risk? The hazard remains exactly the same-it’s still a very dangerous tiger. The risk still exists, but it has been drastically reduced, by the use of a single control measure - a glass barrier.
In this case the barrier is likely to be almost 100% effective, so the general public can view the tiger without even really considering the risk.
Most risk situations aren’t as simple as this, but having a clear understanding of the difference between a hazard and the risks that arise from that hazard will help you to evaluate the risks and also to decide on what you might need to do to control those risks.
So, when you come across a hazard of any kind, the first question you need to ask yourself is “how can this hazard cause harm?”. The answer to that question should start to give you an idea of what sort of control measures you might need to use to reduce the risks associated with that hazard.
It’s important to realise that a single hazard may present more than one risk issue. Some of those risks might be obvious and others not so obvious. For example, a hazard such as an electric circular saw has the potential to cut your fingers off, but it also carries a risk of causing damage to your hearing, indirectly causing damage to your eyes and then there’s also the risk of electrical shock, it the cord isn’t in good shape. With a hazard such as forest fire, there are some obvious safety risks, but there are also some major financial risks as well. Clearly different risks will need different controls.
So, when you ask yourself “how can this hazard cause harm?” try to think outside the box, use different perspectives and think about the dimensions of risk that could be affected.
There’s a short quiz after this lesson, which will only take a minute or two, so blast your way through the questions before moving on to the next lesson.
Consequence x Likelihood
The real value of risk thinking is that it takes into account not only the consequences of a hazard, but also how likely that event might be.
An event like a lightning strike might have very severe consequences, but in most places it’s not very likely to happen, so the level of risk is low. But, If you live at the top of a hill in thunderstorm alley, then it’s much more likely that you’ll get hit by lightning, so whilst the consequence is the same, based on where you live, the risk may be much higher. Similarly, the consequences of a flood event might be less severe than getting hit by lightning, but if you live in an area that’s prone to flooding on a regular basis, then the risk level posed by flooding might be higher than that of getting hit by lightning, even though the consequences are less severe. So to calculate a level of risk, first of all we need to define the consequence and then try to find out or estimate how likely that is to happen.
Risk can usually be defined by a simple equation: Risk = Consequence x likelihood As I said earlier, risk and reward are like two sides of the same coin, so if risk is consequence times likelihood, then the associated reward would be defined by; benefit x likelihood.
In financial risk calculations, actual numbers are used in these equations, but for health and safety risks, home emergency risks or any risk that isn’t easy to represent with a number, descriptive terms can be used.
Often, particularly in health and safety risk, a risk matrix can be used to calculate and represent a level of risk. A risk matrix will have pre-defined descriptive scales for consequence and likelihood and is a simple, easy to use visual tool that can help to identify which risks are more, or less, critical to deal with. Clearly the risks that sit in the red area are the ones that we would need to place extra attention on and the risks in the green area are generally going to be ones that we don’t pay much notice of.
So, in this green area we have the low consequence, low probability risks, and in general we’re going to be happy to take those risks. In the red area we have the high consequence, high probability risks, that we’re going to try hard to avoid. Somewhere in the middle of this orange area will be a line that divides the risks that we are happy to tolerate and the risks that we are not comfortable with. This line of risk tolerance will be in a different place for everybody and will probably change over time too.
The risks that fall higher up the scale are the ones that we need to prioritise. There’s no point concentrating on a risk that is very unlikely to happen, when there are other risks that might cause problems on a monthly or seasonal basis.
For most risk situations, outside of a workplace, we’re not going to use a risk matrix, but the actual risk decision-making will be the same. Identify the consequences, then decide on how likely you think that is to happen. After that you’ll have a fairly good idea of how high risk of an activity you’re considering. At that point you have to then think of the rewards that you’re taking that risk for. If the risk outweighs the rewards, don’t take that risk. If the reward outweighs the risk, then you should probably bite the bullet and take that risk!
Reducing risk levels
Once we’ve identified a risk that we’re concerned about, we then need to decide what we’re going to do about it. Our goal should be to bring the level of risk as far into our comfort zone as possible - as far below our line of risk tolerance as we can.
In the tiger example a hard barrier was used to reduce the risk of the hazard coming into contact with the child, but in most cases a hard barrier isn’t going to be a practical solution to the problem.
A good start is to think about what we’re already doing to reduce the level of risk. Usually, if we are exposed to a risk we’ll be doing at least something to control that risk. For example, if you’re concerned about the risk of a fire in your house, you will have installed smoke detectors, as a minimum, and possibly have a fire blanket in the kitchen or a fire extinguisher somewhere? You probably try not to leave hot fat unattended on the stove top and use a fire guard around your heating fire? Depending on your building type, you might have an escape plan? Once you’ve identified the things that you already do, then it’s worth checking that those things are effective. That means check the batteries on your smoke detectors, practice your escape plan, and check the pressure on your fire extinguisher.
If you’re still not comfortable with the level of risk, then it’s time to think about what else you need to do. There is a tool called the “hierarchy of controls”, which is most often used in workplace health and safety, but is just as useful for any safety risks, like home safety and can even be useful in recreational high risk sports. The hierarchy of controls is designed to help you choose the most effective risk reduction treatments. At the top are methods that are highly effective, but the further down we go, the less effective these treatments become, and the more input and maintenance they will require.
At the top of the hierarchy is elimination. Obviously, if you can eliminate a hazard the risk goes away, but in general this option isn’t going to be practical. If it was, we’d have eliminated it already!
If you can’t eliminate a hazard, maybe you can substitute it for something less hazardous? Substitution is particularly useful for substances. Let’s say you’re using a cleaning product containing a flammable solvent like methyl ethyl ketone. Could you use a less flammable alternative, like methylated spirits, or even soap and water, with a bit more elbow grease?
One step down are the engineered controls. That’s something that you construct to get as close to eliminating the risk as possible. That’s the tiger example-the hazard is completely isolated from the elements at risk by the barrier. Now, it’s important to note here that the risk has not been eliminated, because the tiger is still there, but it is effectively isolated, which is almost as good...as long as the barrier remains intact!
Another example of an engineered control could be if you’re concerned about wildfires burning your house down, you could remove all the trees and flammable plants from around your house, to ensure that there’s a sufficiently large buffer between the forest that could set on fire, and your house. You might also install a sprinkler system, either inside your house, or in the garden. Another example of an engineered control would be the choice of material you build your house from. Cedar wood wall cladding is a lot more likely to catch fire than brick or iron.
These top three controls are often called the “hard controls”, and in general are going to be more effective than the remaining two controls. They are also going to be more expensive and in some cases all these options just aren’t practical.
Often we’re left with the next level down, which is the administrative controls. These are things like experience, training, rules and regulations, signage, practices and drills, safe operating procedures and so on. In the wildfire example these would be things like grounds maintenance - sweeping up any flammable leaves from the ground, evacuation practices, and most importantly, taking action from warnings.
Right down at the bottom of the hierarchy is PPE-personal protective equipment - safety gloves, hard hats, high visibility clothing and such like. In a sports situation, that’s your lifejacket, helmet, shin guards, gum shield, sunscreen, and anything else that you wear to make your sport safer. Now the fact that PPE is at the bottom of the hierarchy doesn’t mean to say that PPE is useless. Far from it, but it should only ever be seen as a last line of defence from a hazard.
Most risk control situations will require that multiple lines of defence are used, so when choosing controls try to choose from the top of the hierarchy if you can, and then use as many of the lower controls as you need to reduce the risk until it’s well within your comfort zone.
So the hierarchy of controls is a great tool for helping to select controls for safety risks, but if your concern is financial or reputational risks, then this hierarchy isn’t particularly useful. Often for financial risks our best option is to transfer the risk to somebody else - insurance. Or share the risk by having other investors in your project. If you’re a business owner, one of your biggest risks will be to your reputation, and finding suitable controls for that risk is usually a bit of a challenge, which will involve every aspect of what you do.
Risk and resilience
So far in this course we’ve been focussing on getting to know our risks and how to use some structure to help reduce those risks. Obviously, our goal is to try to avoid nasty surprises and prevent harm, whilst maximising the opportunities that taking risks can offer. Using a risk-based approach certainly helps to achieve this goal, and the more we practice identifying, assessing and treating risks, the more likely we are to stay on the positive side of the risk / reward balance.
But all too often it’s the unpredictable events that take us by surprise and throw our lives into turmoil. No-one ever predicted that the Eyjafjallajökull volcano would send an ash cloud over Europe and cause the largest disruption to airline travel since World War Two. Or that a terrorist organisation would hijack 4 planes and crash them into the World Trade Centre and the Pentagon. Similarly, our own personal lives are sometimes disrupted by completely unpredictable events like relationship issues, diseases, accidents, crimes or disaster events. The main problem with these unpredictable events is that they happen more often than we like to admit! And because these sorts of things are unpredicted it’s not possible to treat them with our usual risk methodology and often they are a true test of our resilience. Resilience is the process of adapting well in the face of adversity; It means "bouncing back" from difficult experiences. In reality, that “bounce” is likely to be a long and often hard struggle, that requires strength, courage, commitment and grit.
Now, we’ve all got a certain amount of natural built-in resilience. But, just as some of us are better at taking risks than others, resilience comes more naturally to some people than others.
So how can resilience be learned or developed?
One of the most important factors for personal resilience is whether you view an event as traumatic, or whether you can see that same event as an opportunity to learn and grow, or somehow benefit from it happening. An event is only traumatic if you think it is... Clearly, there are some events that are undeniably traumatic and in these cases, the first thing to do is recognise, and then accept, that you are in difficulty. Once you’ve realised that, you’ll be able to take actions to move through the trauma and fight your way back to your normal, or better, self.
People who keep calm and evaluate a situation rationally are much more likely to make good choices and recover from trauma quickly. Keeping calm isn’t as easy as it sounds and everyone has their own way of doing it-some people meditate, others find calm through exercise, others read or write, and others go shopping or practice yoga. Whatever it is that helps you stay calm is the right thing to do during traumatic events.
You need to have confidence that you can overcome the difficulties. This confidence might seem distant, but focussing on your strengths and abilities will help to build that confidence and work out what you might need to do. Realising the ways that you are already resilient will help to give you the confidence you need.
Physical fitness can be an effective means of keeping your mind calm and boosting your confidence.
Staying busy is another great way of keeping calm, plus it has the added bonus of helping you get closer to your goals.
But for most people the single biggest factor in your personal resilience is who you surround yourself with. A supportive network of family, friends and local community can help with practical things as well as giving you a sense of belonging and purpose. Your family and friends will be the first port of call to get help, and getting help is good.
Your personal resilience will help you get through hard times and recover after traumatic events, but developing these characteristics and habits is something that takes time and is far more useful if its built into your person before its really needed.
So, what about the resilience of your business? Really, the same things apply. Having a good handle on the risks that your business faces and then taking appropriate risk reduction measures will help to ensure that shocks to the system are minimised. When unforeseeable events happen there may be new opportunities for your business-it may even help to grow your sales or allow you to offer new products and services. A business continuity plan is a great way to help with the initial response to a disruption, and in order to stay afloat, your business will need to acknowledge any changes in the business environment and then creatively adapt to the new conditions. Staying calm and confident will require strong leadership and good engagement with staff. Your business networks and partnerships will be needed for support and to ensure you can get the resources you need.
Whether we’re talking about personal, business or even community resilience, risk is only a part of the picture to achieving resilience. Reducing risks and developing the qualities and characteristics for resiliency takes time and is far more useful if it is worked towards long before its really needed.
More Risk Resources
is a Youtube Channel run by Andrew Maynard, who is a professor in the School for the Future of Innovation in Society at Arizona State University, and Director of the ASU Risk Innovation Lab. There are lots of quirky, easy to understand animations about risk.
Risk Views is a long running blog about risk and enterprise risk management (ERM). With ten years’ worth of contributions from some of the World authorities on risk.
Risk Factor is a Canadian social media campaign designed to improve the public understanding of risk. They have an awesome mobile app, which allows you to compare the risks of many activities you do.
Understanding Uncertainty is a website created and run by Professor David Spiegelhalter of Cambridge University (UK). Tons of in-depth information about risk.
Risk-Ed is a website designed to help you understand risk. It’s a fun approach to risk education and has an environmental focus.