Transcription
OPERATIONAL RISKMANAGEMENT GUIDEU.S. DEPARTMENT OF AGRICULTUREFOREST SERVICE2020Last Updated 02/26/2020RISK MANAGEMENT COUNCILIN COOPERATION WITHTHE OFFICE OF SAFETY & OCCUPATIONAL HEALTHandTHE NATIONAL AVIATION SAFETY COUNCIL
ContentsContents. 2Executive Summary . iIntroduction . 1What is Operational Risk Management? . 1The Terminology of ORM . 1Principles of ORM Application . 6The Five-Step ORM Process . 7Step 1: Identify Hazards . 7Step 2: Assess Hazards . 8Risk Assessment Matrix . 8Risk Assessment Tool. 13Step 3: Make Risk Decisions . 15Identifying Risk Management Strategies . 15Evaluate Risk vs. Gain . 16Risk Decision Authority Chart . 17Step 4: Implement Controls . 17Step 5: Supervise. 20Communicate, Evaluate, Validate . 20ORM Process Examples . 21References . 23Appendix 1: Risk Assessment Worksheet . 244Appendix 2: Risk Assessment Matrix . 24Appendix 3: Risk Assessment Codes . 27Appendix 4: Risk Assessment Tool . 29Appendix 4: Risk Decision Authority Chart . 29
Executive SummaryTo accomplish the mission of the U.S. Department of Agriculture Forest Service, we expose employees,volunteers, and contractors to a wide variety of environments ranging from secure office settings toextremes of weather, terrain, fires, and floods. All these workplace situations have hazards that presentsome degree of risk of harm to employees. Fortunately, most of the risk our employees face ismanageable through deliberate, collaborative, and thoughtful risk management. This guide exists to helpmanagers and employees identify and communicate value and objectives, identify risks, evaluate how tomitigate them to the lowest practicable level, and then decide if the value or attempting to achieve theobjectives is worth accepting the residual risks.The Operational Risk Management (ORM) process can be used to assist agency leaders, supervisors, andemployees with identifying and mitigating risk associated with the work we perform. This guide providesa format for employees to conduct a thorough discussion of the various levels where ORM can be applied,illustrates uses of the tools, and contains reproducible forms in the Appendix.Essentially, all Forest Service actions seek to meet multiple objectives, not just safety-related objectives.This guide is written to be inclusive of managing the risks associated with meeting any objective,especially the objective of no harm to employees. The ORM process and the newly developed riskassessment worksheet, when signed by a line officer or other approved authority, can replace the JobHazard Analysis (JHA) form.i Page
Send comments to Branch Chief Risk Managementsteve.holdsambeck@usda.govii P a g e
IntroductionThe U.S. Department of Agriculture Forest Service is embracing development of an Operational RiskManagement (ORM) process to better plan for and address the inherent risks that our employees face.Adoption and implementation of ORM will allow the Forest Service to enhance employee capacity toidentify, evaluate, and mitigate risks across the full spectrum of work activities and improve the ability tomake risk informed decisions and ultimately accomplish objectives as safely and efficiently as possible.The ORM Guide has been developed to describe and clarify an ORM process to be used in project,incident, and work activity decision making. (This guide will use the term “project” to represent allincidents, projects, or work activities from here on out.) The intent of this guide is to: Clearly define four principles that guide a five-step ORM process. Describe how to apply ORM in all Forest Service activities. Provide a sound foundation for creating a greater understanding of the importance of ORMthrough education, training, and application. Guide the incorporation of ORM into the full spectrum of Forest Service project/incident/workactivities.What is Operational Risk Management?ORM is a continuous, systematic process of identifying and controlling hazards to increase the certaintyof outcomes. This process includes detecting hazards, assessing risks, implementing controls, andmonitoring risk controls to support effective risk-based decision making. “Risk management is essentiallydecision making under uncertainty” (Thompson et al, 2016). ORM involves identifying, assessing,decision making, implementing controls, and supervising. Furthermore, ORM seeks to harness feedbackand input from all organizational levels to make the most informed decisions possible while reducingunintended outcomes.ORM has a specific goal:Enhance employee’s ability to anticipate hazards and reduce the potential for loss, therebyincreasing the probability of a successful outcome.The Terminology of ORMA clear understanding of ORM terminology is a prerequisite to effective communication of risk,decisions, and controls.Risk: Risk is “the effect of uncertainty on objectives” as defined by the International Organization forStandardization (ISO 31000). It is typically expressed as an estimate of the probability and severity ofconsequence of uncertain future events.In situations where outcomes and consequences are known, calculations of risk are possible. For example,the probability of the dealer winning a single hand of blackjack is approximately 51%. The consequenceis the win or the loss.1 Page
This ORM guide is designed for use where absolute calculations are not possible, such as the risks ofworking in the wildland environment. Here the odds of various outcomes are estimated based onexperience and the context of the situation, using tools discussed later in the guide.Risk is characterized by different types. These are: Identified risk: Risk that has been determined to exist. Simply stated, identified risk is the riskthat we recognize as existing that could reduce the likelihood of achieving our objective. Unidentified risk: Risk that has not been identified but has some effect on the likelihood ofachieving our objective. Some risk is not identifiable or measurable but is no less important. Total risk: Total risk is the combination of both identified and unidentified risk. Ideally,identified risk will comprise the much larger proportion. Residual risk: The portion of total risk that remains after mitigation measures have beenemployed. Residual risk comprises acceptable risk and unidentified risk. Acceptable risk: The risks that are acceptable in order to meet objectives. Acceptable riskincludes the residual and unidentified risks determined to be acceptable based on the importanceof meeting objectives. Unacceptable risk: That portion of identified risk that cannot be tolerated and must be eithercontrolled or avoided.Probability: The likelihood or the chance of an event occurring.Severity: The magnitude of impacts or consequences stemming from an event.Consequence: The outcome or effect of an event or incident, usually evaluated with respect to objectives.Severity/ Consequence: Both terms are used interchangeably. Both refer to the impact that a hazard couldhave on the objective. Therefore, in this guide, both are defined and used together where referenced.Hazard: Any real or potential condition that can cause damage, loss, or harm to people, infrastructure,equipment, natural resources, property, or objective.Threat: An event, individual, entity, or action that has the potential to harm life, information, operations,the environment, or property, or a combination thereof. Often the words ‘Hazard’ and ‘Threat’ are usedinterchangeably.Exposure: A term used to assess the amount of time a resource or a value is proximally in a position to beharmed by a hazard. Exposure is a tool used by risk managers to manage the risks to meeting objectives.In other words, risk managers use the tool of exposure to decrease the overall risks of the project. On awildland fire, for example, risk managers deliberately expose employees to many hazards in order to meetincident objectives including the objective of no harm to employees.Safety/ Safe: The term ‘safe’ is often used to describe a situation free from danger, risk or injury, or whenthere is certainty that objectives can be met with positive outcomes. As previously stated in this guide,most work performed by Forest Service employees involves some form of risk. ORM seeks to reduce riskto manageable levels and recognizes that in most cases, there is some residual risk. Therefore, mostoperations are never ‘risk free’ or totally ‘safe’. Also stated in this guide, ORM is not a guarantee that wewon’t experience negative outcomes, such as serious injuries or property damage. We can also experiencepositive outcomes when risk management decisions were poor, yet we often conclude the project oroperation was ‘safe’ simply because we did not experience a negative outcome. When working through2 Page
the risk assessment process it is important to focus on the process itself, which includes identifying thepotential gains of the work versus the potential costs, or losses, and then making informed decisions onrelative risk. It is best not to confuse the Risk Management process with subjective concepts such as‘safe’.Values at risk: Those ecologic, social, economic assets, and resources that could be impacted by a hazardor threat.Risk assessment: Process or product that collects information and assigns values (relative, qualitative, orquantitative) to risks for the purpose of informing priorities, developing or comparing courses of action,and informing decision making.Risk control: A strategy or deliberate action taken to reduce the potential for loss, maintain risk atacceptable levels, or enhance the potential for benefits, in a manner consistent with objectives, desiredoutcomes, and the management context. Some types of controls include engineering controls,administrative controls, and personal protective equipment (PPE).Risk management: The deliberate action taken by an organization or individuals to manage risk. This isachieved by the identification of opportunities and threats and the allocation and use of resources toincrease the odds of success, avoid hazards, minimize consequences and provide for recovery. Riskmanagement seeks to reduce risks to acceptable levels. In most endeavors, we will not be able to reducerisk to zero.The risk management process operates on four connected and affiliated levels: enterprise, strategic,deliberate (operational), and real-time (time-critical). Although the concepts at all levels are similar, thescope varies from the agency mission to a single tree
26.02.2020 · Risk that has not been identified but has some effect on the likelihood of achieving our objective. Some risk is not identifiable or measurable but is no less important. Total risk: Total risk is the combination of both identified and unidentified risk. Ideally, identified risk will comprise the much larger proportion. Residual risk:
