Emphasizing on the Neglected Parts of Risk Management Process in Occupational Health and Safety Management, Using the European Statistics for Accidents at Work Codification, Communication – Human Information Processing Model and Management Standards

Scope, Context and Criteria

This is a frequently neglected part, as it is considered for granted: all risks in OHS are about human life and health and, hence, their minimization or elimination is the undebatable goal. Although this holds true, setting up the scope is quite necessary to manage risks. Scope includes all risks and situations that will be managed in this management context (e.g. are risks related to third parties, the environment or materials managed in this context or differently). There are several risks for an organization and not all of them are treated in the OHS context. Defining the scope is important as boundaries are not always clear.

Definition of the context is also very important. Although minimization of OHS risks is an obvious and granted aim, its context needs to be clarified, as it defines criteria. For example, internal motivation for safety, OHS legislation and economic consequences are granted for all enterprises, however for some of them other parameters also exist (e.g. ESG compliance, compliance with holding company’s standards, management standard certification, public concerns for critical sectors, operation in a pandemic, etc.) All these factors could set acceptance of risks, as well as criteria for risks in different levels. This differentiation does not only apply for different organizations, but also for different risks within the same organization. In order to identify risks (i.e. What consists an OHS risk) and evaluate them objectively, definition of criteria is very important.

Risk assessment: According to Figure 2, the stage of Risk Assessment includes the following stages:

• Hazard Identification
• Risk Identification
• Risk Evaluation Hazard identification is an important stage for OHS, because there is a large number of risks to be identified and a structured approach is required in order to identify all risks. A hazard is a situation that could lead to risk for those exposed to it. In other words a risk is the conjunction of hazard and exposure. Although there are many methodologies in literature for this process, a more documented one comes from utilization of Eurostat’s [3] taxonomy. This taxonomy can be presented as follows Figure 3.

Click to enlarge

According to this taxonomy an injury is a result of a contact, caused by a deviation that was the result of a specific physical activity in a working process in a workstation of a certain working environment. In all these stages, the common element is the material agents, i.e. the infrastructures and materials (i.e. workplace building/area elements, equipment, vehicles, materials and substances).

ESAW taxonomy includes about 1300 codified types of such material agents.

An identification and subsequent listing of these material agents in each workplace can then lead to identification of all hazards typically linked with them, making sure that everything has been taken into account. This will lead to a complete and assured identification of risks (identifying to which of them exposure exists), compatible with the approach followed by authorities in investigating accidents.

For health risks the procedure is similar but with some differences. Hazards are harmful factors (physical, chemical, biological and ergonomic) linked to working with the specific material agent. Exposure to these hazards is not directly an incident (like in accidents) due to larger latency period and uncertainty of the cause-effect relation for health risks.

After this systematic identification of risks, the Risk Evaluation stage is common by using a risk matrix with a common scale (e.g. 5X5) for all workplace, including both likelihood and severity, leading to a combined value of the magnitude of risk.

For example, a material agent listing could identify a balcony, which, according to ESAW taxonomy falls in the category “parts of a building above ground level” (Code:

02.01 .99.00). Among all hazards associated with this, people falling from the balcony (ESAW Deviation Code 51: “Fall of person - to a lower level”) and materials falling from the balcony (ESAW Code 33: “Slip, fall, collapse of Material Agent - from above (falling on the victim)”) can be identified. These will lead respectively to “Contact-Mode of Injury” ESAW Codes: 31 “Vertical motion, crash on or against (resulting from a fall)” and 42: “Struck - by falling object”. Of course, there are more risks associated with the certain material agent and deviations, but only these two are mentioned here for simplicity.

Having identified these two risks, evaluation will follow, say in a 4X4 risk matrix (Table 1), worker fall from height risk could be assigned a “Low” likelihood [5] and a very high severity [3] leading to a “High” risk evaluation [6]. Object falling risk could be assigned a moderate likelihood [7] with a moderate severity [5] leading to an “Important” risk evaluation [3].

Risk Treatment

An important stage of the core process that is usually not systematically applied in occupational risk management is Risk Treatment. Usually “reasonable” measures that reduce the risk are arbitrarily proposed and followed to the extent that they are feasible only (or mandated by OHS legislation). However, Risk Treatment is an absolutely important stage that has to be systematically applied, in order to maximize the results of the proposed measures and optimize allocation of resources available for OHS.

The hidden factor behind this pitfall is that due to the importance of the consequences (human life and health is at stake) prevention (i.e. elimination of risk before its occurrence) is considered as the only acceptable strategy. Therefore, no selection of strategy actually takes place. Nevertheless, prevention is not always possible or feasible and other strategies are actually followed, under the name of prevention. The result is that neither prevention is followed, nor the followed strategy has been identified in order to be optimized.

Risk Management has a number of strategies (under different names and grouping in different literature), some of them being relevant to OHS risks:

• Prevention. Elimination of the hazard to exclude (or reduce as much as possible) the possibility to turn into risk. It is the most common strategy. It is the most proper in cases of major risks (mainly in terms of consequences) or when elimination of risk is practically easy (e.g. installing a residual current device - RCD in electrical installations).
• Mitigation. Acceptance of the risk and attempt to reduce its consequences. This is usually the case of risks of high frequency that cannot be easily prevented (e.g. objects falling from higher levels), so that emphasis is given on protection of people (e.g. wearing hard hats) in order to reduce risk through severity.
• Exposure reduction. Acceptance of the hazard and efforts on minimizing (or eliminating) exposure of workers in it. This is the case in major hazardous sources (e.g. a power substation), where technical interventions to reduce risk are not feasible and focus is on elimination or minimization of individual exposure to the hazard.
• Concentration. Concentrating risks and treatment resources in time, spatial point, process or individual (“putting all eggs in one basket”). This is the case in risks that are hard to be reduced and/or excessive resources are required for reduction (e.g. reducing the noise produced by a machine in a workplace). Risk is contained in a smaller area (e.g. isolating an area around this machine) and individuals exposed, where all available resources are also concentrated.
• Diversification. Spreading risk in time, space, processes or different individuals (“not putting all eggs in one basket”). This is the case mainly for exposure to harmful factors that cannot be easily prevented. A common example is rotation of workers in such tasks (e.g. of high exposure to vibrations) in order to reduce total individual exposure.

For each risk at least one (or more if compatible) strategy has to be selected according to its features. Of course, prevention is preferable when possible. Measures have then to be selected according to this strategy. Not all measures against the same risk can be effective together. Only measures of the same strategy can be effective in terms of result and feasible in terms of resource allocation. For example, if concentration has been selected for noise with measures such as containment of the noisy machinery in a certain area and installing a noise insulated control room for its operators, provision of earmuffs, audiograms and training for all personnel would consume resources without any important effect. At the extreme, job rotation could have a reverse effect (people would be in and out of the control room being exposed to noise).

However, even when aligned to the selected strategy, not all measures are the same important. Evaluation must take place not only for risks but for measures as well, in order to prioritize them. Some measures (e.g. an RCD in an electrical installation) could have a great impact in reduction of a risk (e.g. electrocution), whereas others (e.g. signage) could have a smaller impact for the same risk. The value of a measure depends on the number and magnitude of the risks it is addressed to, as well as the impact it has on each one of them, which is different for every risk. Actually, the total impact of a measure is the sum of the products of its impact against each risk times the magnitude of the risk. For the example of the risks of Paragraph 3.1 identified for a balcony, fall from height had a magnitude of 5, whereas being struct by falling object had a magnitude of 4. If presence of people and materials in the balcony is inevitable, then mitigation of risks might be the selected strategy. Two relevant measures in this strategy could be fencing and hard hats. Using a scale of 1-4 for impact of a measure, we assume that fencing would have an important impact against fall from height (say 3), and low for falling objects (say 1), whereas hard hats would have a small impact for fall from height (say 1) and an important impact (say 3) on falling objects. Hence, the total impact of fencing is 3 X 5 + 1 X 4 = 19, whereas the total impact of hard hat is 1 X 5 + 3 X 4 = 17.

Selection of measures is a composite qualitative process that takes into account their relevance to the selected strategy, their quantified measure values and the consequent prioritization of each one. Of course, effectiveness of the measures is evaluated after their implementation, however, it is necessary to have a prior selection methodology.

Communication and Consultation

This procedure includes two discrete but interacting functions that concern the contact of the core Risk Management process with its environment. This function is usually performed arbitrarily, partially and in single direction, as information about measures. Hence, it is a common phenomenon to report deficiencies (“they don’t listen”), as the whole function (“do we listen?”) is neglected. Communication is bidirectional (including Consultation), importing evidence and knowledge of risks from the environment to the Risk Management process and it also exports information of risks and measures to the environment, where they are addressed to. The environment is both the internal (e.g. the workplace) and the external (e.g. suppliers, contractors, partners, customers, authorities, etc.) The main difference between the internal and external environment in Communication and Consultation is alignment. Internal environment includes parties with declared aligned objectives (those of the enterprise) and discipline may apply. External environment consists of parties with different objectives (or even agendas) and only negotiation and consultation may apply. This difference is critical in Communication and Consultation.

In terms of Human Factors, Communication is generally described by the Communication–Human Information Processing model [4], which is a handy model that summarizes all main stages of human information processing and the communication cycle. It includes all stages of the way information is processed by humans, also examining the function of the message in these processes Figure 4.

Click to enlarge

This model starts with the general design of the message, which includes the source, who is communicating the message, the channel, which is the form of the message (verbal information, fixed sign, alarm, etc.) and the delivery, which includes the way (time, locus, frequency, etc.) in which the message is distributed. At this stage, the effect of the environment (“noise”, features, etc.) is the dominant.

After arrival the internal cognitive stages of attention switch and maintenance on the message, comprehension of its content, formulation of attitudes and beliefs against the intended behavior, motivation to follow this behavior and finally its application. Although a thorough human factors analysis is quite demanding, a plan according to this communication model needs to be developed for each risk that has been identified, evaluated and for which measured have been selected, so that the form of communication and basic principles are defined.

A more detailed analysis needs to take into account various aspects of risk perception, such as biases. Indicatively, some types of biases are briefly presented in relevant groups.

Some biases are related to a perception of differentiation (compared to other individuals) that the individuals develop against the risk. It includes:

• Optimism bias [8]: people tend to feel that for some reason the risk is lower for them
• Dunning-Kruger effect [9]: the tendency of people to overstate own capabilities and skills
• Self-defensive attribution [10]: people tend to explain risk in a way that minimizes their personal responsibility
• “Just World Belief Theory” [11]: people tend to attribute exposure to risk to certain characteristics of the exposed person, assuming themselves safe as they do not share these characteristics.
• Another group of biases has to do with workplace organizational inertia. They include:
• Status quo bias [12]: people tend to prefer an existing situation (“the devil you know”) overestimating the difficulty of transition to another situation.
• Herd behavior [5]: people adopt views and attitudes of the majority, rather than their own
• Confirmation bias [7]: people tend to seek for evidence that support someone’s existing opinion, neglecting evidence that oppose it
• Cognitive dissonance [6]: people create theories in order to support their own habits.
• Another category is biases that have to do with temporality and duration of exposure to risk. They include:
• Accumulation bias: each exposure to risk is taken as independent and separate without seeing the cumulative exposure for a long time (e.g. car crash probability 0.00001 per each trip rather than 0.33 for 50 years of driving – [13])
• Present bias [14]: people tend to underestimate future risks
• Hindsight bias [13]: people focus on recent incidents underestimated the risk of incidents that have not happened recently.

The C-HIP model includes loops in all of its stages. Apart from the looping process of cognitive processing, these loops indicate the bidirectional nature of communication, where consultation is also included. This is the import of information from the environment to the system in order to improve both the core process and the communication itself. Communication is also directly linked to Recording and Reporting, as well as with Monitoring and Review that actually structure and document communication.

Recording and Reporting

OHS management cannot be set up once and be left to run alone. Both risks and efforts need to be recorded and analyzed as well as to be communicated to all parties involved. Some recording and reporting is mandated from legislation (accident and prevention reports to authorities), some is compulsory by initiatives (publication of OHS indices in ESG) and some is imposed by application of OHS management standards, like ISO 45001:2018 [1].

The latter focuses on quantification of data and structured reporting mechanisms, so that the situation, both related to the state of risks and related to the efforts against them, can be evaluated and revised when necessary, as presented in the next Paragraph. Although quantification is not always possible, it is the most objective way to assess the situation and when this is not possible, certain qualitative criteria must be set.

Every risk that has been assessed and treated in the core process has to be recorded with the relevant evaluation of the risk and its measures. More specifically, a risk registry should include for each risk:

• Scope, context and criteria: who are involved, major affecting factors, quantitative criteria?
• Evaluation: likelihood, severity and overall risk value.
• Treatment: Strategy, goals (related to criteria) and related measures (with evaluation).
• Communication: recipients, means, etc.
• Reporting: reports per party. Ideally, a quantitative linking between measures and risk evaluation [15] should be in place where possible. Incidents (either accidents or near misses) need also to be recorded with all necessary details and evidence. Internal and external audits (particularly non-conformities identified in these audits) also need to be recorded, along with complaints or advices from internal and external parties (workers, experts, etc.).

All this information of different form, nature and sources, needs to be digested and processed in order to improve knowledge. This function needs to be structured and documented; hence a plan of how this information is collected and how data will be used needs to be in place. Registration is completed when various indices are present, in order to be used in the next stage, which is reporting.

Reporting is the communication of registered information to all parties. Although registration itself requires communication (outside-in by importing information), reporting refers to inside-out communication from the OHS management to the parties. This information is not uniform, but has to be adapted to the characteristics and requirements of the recipient.

For example, reporting to lower echelons (e.g. departments, workers, etc.) needs to include detailed information only about the domain risks. On the contrary, reporting to higher echelons (e.g. top management) needs to be holistic and concise, i.e. less detailed, presenting overall indices, evaluation compared to the goals and comparative illustrations. Other reports include the official ones, attended to the authorities, sustainability reports to the general public, or specific reports where necessary (e.g. Customers – users of products or services, suppliers, etc.) A complete mechanism of reports needs to be in place in order to be continuously updated by new recorded information.

Monitoring and Review

Risk Management and particularly OHS management are not static. Organizations evolve, environment changes and new knowledge arrives, so that the whole function needs to be continuously revised. New risks need to be identified, evaluated, be treated, communicated and recorded, old risks have to be updated, measures need to be re-assessed and planned, etc.

Revision is present in practically all OHS management tools. Particularly in ISO 45001:2018 [1], the whole process is based on a loop scheme: Plan- Do- Check- Act, which represents the continuous monitoring of the situation and revision (Figure 5).

Click to enlarge

Since the process of review is continuous, a certain continuous monitoring mechanism needs to be in place, based on incoming communication and recording of previous stages. Moreover, discontinuous monitoring also needs to be in place, after extraordinary events, such as new regulations or guidelines, new operational processes or material agents, important incidents or non-conformities, etc. The example of the Covid-19 pandemic that changed everything about risk in workplaces is a vivid example of the necessity to keep the OHS system flexible enough to digest major changes when required.