Risk assessment and management continued, continued

Risk Assessment – Risk Identification:

Risks need to be identified in terms of what, why and how things can arise so further analysis of the risk can be undertaken. This step should identify any risks arising from the operating environment and generate a comprehensive list of risks that could impact on those objectives.

For some activities, especially safety related activities, hazard identification is the first step when identifying risks. A ‘hazard’ can be a situation that poses a level of threat to life, health, property or the environment.

Risks can be identified using the following tools:

• audits or physical inspections
• accident / incident reports
• brainstorming
• decision trees
• history
• interview / focus groups
• personal or organisational experience
• scenario analysis
• strengths, weaknesses, opportunities and threats (SWOT) analysis
• survey or questionnaires.

Some questions to ask when identifying risks:

• When, where, why, and how are the risks likely to occur?
• What is the source of each risk?
• Who is likely to be affected by the risk?

Identified risks will be documented on the Risk Control Worksheet available in the downloads below

Risk Assessment – Risk Analysis:

The objective of this step is to separate the broadly acceptable risks from those risks requiring subsequent treatment. For each identified risk the existing controls need to be analysed in terms of consequence and likelihood in the context of those controls.

A control is defined as a measure that modifies a risk i.e. reducing the consequence and / or likelihood. Controls include any policy, process, practice, device, people, or other actions which modify risk. The method of analysis to be applied will depend on the particular application, the availability of reliable data and the decision-making needs of the activity.

Risk Assessment – Risk Evaluation:

An evaluation of each identified risk will be conducted to determine those risks that are acceptable and those that require further treatment. Risks that require further action will be mitigated prior to any RPAS operations. The risks that have been accepted will be noted and monitored in accordance with ‘Monitor and Review’ process detailed below.

Existing controls and their effectiveness must be taken into account when analysing the risk to derive a Risk Rating score. Details of this risk analysis should be recorded on a Risk Control Worksheet. The analysis will consider the range of potential consequences and how likely they are to occur. Consequence and likelihood are combined to produce an estimated level of risk called the Risk Rating.

Risk Treatment:

Once you have understood the risks and evaluated them, you need to design treatments with ‘As Low as Reasonably Practicable’ ALARP principles in mind. This does not mean that you have completely removed all risks, but that you have processes in place to control them to a level where the risks are as low as reasonably possible.

Monitor and Review:

The last step in the Risk Management process is to monitor and review the effectiveness and performance of the risk treatment options, strategies, and the management system and changes which might affect it as follows:

• each step undertaken should be documented to enable effective monitoring and review
• risks and the effectiveness of treatment measures need to be monitored to ensure changing circumstances do not alter the risk priorities
• identification, assessment, and treatments must be reviewed to ensure the risks remain relevant and continue to be managed and that any new or emerging risks are identified and manage