Beyond Compliance – QAP Case Study

by
Georgi Popov, PhD, QEP

An Abstract
of a Final Project submitted in partial fulfillment
of the requirements for the Risk Assessment Certificate Program

February, 2015

Beyond Compliance – QAP Case Study

According to the requirements of the Risk Assessment (RA) certificate program, we should be able to:

1. Implement the steps of the RA process

2. Identify and prioritize organizational hazards
3. Establish risk reduction (RR) plans that will align with the business goals of the organization
4. Influence the management to support risk reduction (RR) plans
5. Measure the effectiveness of the RA process and outcomes of the goals

I’ll try to address all the requirements and link them to the deliverables.

Implement the steps of the RA process – I developed tools to address all 3 steps. The tools are based on
PtD and ISO 31000 series standards.

Identify and prioritize organizational hazards – A modified Preliminary Hazard Analysis (PHA) tool was
developed to identify and prioritize the top 3 Safety, Health and Environmental (SH&E) hazards
identified in the case study.

Establish risk reduction (RR) plans that will align with the business goals of the organization – I decided
to include business objectives (BO) prioritization tool, develop SH&E intervention implementation plan,
and later identify the impacts on BO.

Influence the management to support risk reduction (RR) plans. This is a critical area and SH&E
professionals will have to learn how to influence the management. Based on my experience, the best way
to influence the management is to develop RR and business case for SH&E intervention. Numerous tools
are available. However, as Dave Walline emphasized, there is no universal tool to collect cost associated
with injuries and illnesses. Different tools are presented in this final project. They can be expanded or you
can skip some of the tools.

Measure the effectiveness of the RA process and outcomes of the goals. This is another very important
requirement. As Dave Walline mentioned, “What gets measured gets done”. To measure the effectiveness
of the RA process, we have to look at the standards that were referenced during the course. ANSI Z 10
provides suggestions for the following categories: RR, productivity, financial performance, quality, and
other business objectives. RA tools used in this final project are derived from the PtD standard and Bow-
Tie tool is described in greater details in ISO 31010. Some of the tools were modified to provide
visualization. The RR tool is simple percent reduction calculation. In order to address productivity, two
different tools were used: Overall Labor Effectiveness (OLE) and Process Cycle Efficiency (PCE). Both
productivity tools are modified Lean tools and I decided to include them as suggested by the lunch
speaker on Tuesday. Dave Walline again emphasized on the fact that SH&E professionals do not take
enough credit for improved productivity and quality. Therefore, I decided to include OLE and PCE tools
to address some quality issues. Financial performance was measured using cost-benefit analysis tool, as
suggested by Dave Walline (Day 3 of the course). In addition, the financial analysis tool was developed to
calculate the financial benefits (FB) of the SH&E intervention. Other business objectives may be
addressed by capturing the non-financial benefits (NFB) of the intervention.

“Measure the effectiveness of the RA (ERA) process” equation can be presented as:

ERA=RR+ FB+ NFB + PCE+OLE + ETR

Deliverables

The Risk Assessment (RA) Tool was developed to help SH&E students and early career professionals
diversify their knowledge and become important members of the decision making team. The RA Tool
uses 5 Steps to determine and illustrate the benefits and Business Value of environmental, health and
safety projects, programs and activities designed to eliminate, minimize or mitigate the risks to reduce the
(associated occupational injuries and illnesses) or SH&E risk in general. RA tools are based on PtD and
ISO 31000 series standards. ANSI Z 10 requires linking SH&E objectives to financial considerations
(p.57). Provided in the standard is the blueprint for widespread benefits in H&S, as well as productivity,
financial performance, quality, and other business objectives. In addition, slide 19 of Module 1 states that
one of the RA benefits is the “new business of safety”. In order to address the benefits of RA and SH&E
interventions, I had to develop additional tools that provide a blueprint for integration of ANSI Z10, ISO
31000 and PtD standards. We were encouraged by our instructors to use variety of RA techniques listed
in ISO 31010 and modify them as needed. A system approach for integration of various methodologies is
presented in this final project.

The project addresses initial RA, suggested controls (according to the PtD Hierarchy of Controls), two
options for SH&E interventions (including two additional RA), productivity (Process Cycle Efficiency),
quality (Overall Labor Effectiveness), financial and non-financial benefits of the proposed interventions,
and contributions to the business objectives.

The following required deliverables are included in the final project:

A list of hazards with definitions – See Tool 2a Identify hazards. Tool 2a is a modified Preliminary
Hazard Analysis (PHA) form that includes risk level calculation. Risk Level is transferred from Tool 2b.

Sample risk assessment matrix/methodology – See Tool 2b. Risk Assessment Matrix (RAM) "is a
composite of matrices that include numerical values for probability and severity levels and their
combinations are expressed as risk scorings. It is presented here for people who prefer to deal with
numbers rather than qualitative indicators." Source: ANSI/ASSE Z590.3-2011: Prevention Through
Design.

Risk Levels – To define operational risk factors and levels to be used in the case study assessment, a Risk

Assessment Matrix (RAM) with specific risk descriptions was selected. A conventional two-

factor risk assessment matrix (Severity level x Probability of occurrence) from the ANSI

Z590.3-2011 PtD standard is presented. [Note: Other options exist including three or more risk

factor systems which produce a Risk Priority Number (RPN) most often used in Failure Mode

and Effects Analysis (FMEA).] Two dimensional risk assessment matrix was selected for this

case study. The following risk descriptions are adapted from ANSI Z590.3. 2011 Prevention

through Design standard.

Severity of Consequence Level Descriptions

5. Catastrophic: One or more fatalities, total system loss, chemical release with

lasting environmental or public health impact.

4. Critical: Disabling injury or illness, major property damage and business

downtime, chemical release with temporary environmental or public health impact.

3. Marginal: Medical treatment or restricted work, minor subsystem loss or damage,

chemical release triggering external reporting requirements.

2. Negligible: First aid or minor medical treatment only, non-serious equipment or

facility damage, chemical release requiring routine cleanup without reporting.

1. Insignificant: Inconsequential with respect to injuries or illnesses, system loss or

downtime, or environmental chemical release.

Probability of Occurrence Descriptions

1. Unlikely: Improbable, may assume incident or exposure will not occur.

 2. Seldom: Could occur, but hardly ever.

3. Occasional: Could occur intermittently.

4. Likely: Probably will occur several times.

5. Frequent: Likely to occur repeatedly.

Apply Risk Scores - Taking the three hazards listed in the PHA (Tool 2a), use the RAM Severity and

Probabilities ratings (Tool 2b) and the ratings are automatically transferred to PHA (Tool 2a).

The explosion hazard (1 EXP) RAM rating is determined as 15 or Very High Risk (Critical to

Safety risk); the health hazard resulting from Benzene exposure (2 Health) is rated at 16 or Very

High Risk; and the environmental hazard (3 Env) is rated at 12 or High Risk.

Assess Business Risks – A Business Risk Assessment Matrix (BRAM) similar to the RAM is used to

define business impact risk levels. However, the “Severity” rating is replaced with “Extent of

Impact” on business, and the “Probability” rating is replaced with “Likelihood of Business

Losses” as shown in Tool 2c (Assess Current Business Risk). The ratings are provided below.

Extent of Business Losses Impact Descriptions

1. Insignificant: Inconsequential with respect to business losses.

2. Negligible: Minor business losses.

3. Marginal: Business losses triggering external reporting requirements.

4. Critical: Business downtime, significant business losses or corporate image

impact.

5. Catastrophic: Unsustainable losses, total business loss, inability to continue

business operations.
 Likelihood of Business Losses Descriptions

1. Unlikely: Improbable, may assume business loss will not occur.

2. Seldom: Could occur, but hardly ever.

3. Occasional: Could occur intermittently.

4. Likely: Likely to occur several times.

5. Frequent: Likely to occur repeatedly.

Apply Results to Bow-Tie Diagram – Bow-Tie Diagram is used to communicate the relationship between

hazards, controls and consequences. Once the hazards have been identified and prioritized using

the simplified risk assessment matrix (Tool 2b), the results are transferred to a Bow-Tie Analysis

diagram. In a “Conventional” Bow-Tie analysis, only ‘qualitative’ risk descriptions are used.

However, by incorporating semi-quantitative risk factors for severity and probability as shown in

Tool 2d, a modified Bow-Tie can be used. The modified Bow-Tie risk assessment methodology

includes Severity and Probability numerical ratings for SH&E hazards and Extent and Likelihood

of business losses. Corporate image, Ethical and Legal issues were selected for the consequence

analysis. Corporate image was selected based on 12/31/2014 ASSE’s President Message,

available at: http://www.asse.org/risk-management-reputation-is-key/

Legal consequences were selected because it is critical to business, and it is one of the outcomes

of ISO 31010 tool B11: Business Impact Analysis (BIA).

Completion of at least three risk assessments – Initial RA: Tools 2a, b, c, and d. Two SH&E intervention

options: Tools CH1 and CH2, Tools 3b1, 3b2, 3c1, 3c2, 3d1, 3d2.

The material delivered by the participant must include:

Creating a risk assessment team – Tool 1c.

Completing the initial risk determination – Step 2: Tools 2, a, b, c, and d.

Documentation of the agreed upon initial controls and determination of residual risk – Step 3 Tools 3a1,
Process FS1, Tool CH1, Tools 3b1, 3c1, 3d1, 3e1.

One of the key messages from the course was that only Substitution/ Elimination can reduce Severity.
Therefore, Substitution with less toxic chemicals was considered. Other control measures were added as
well. A more advanced version of this RA tool includes Bow-Tie and Layers of Protection Analysis
(LOPA) integration. LOPA is another ISO 31010 tool used for risk assessment. However, the
methodology described above is not included in this final project to avoid over complication.

ALARP – In our case, acceptable/tolerable risk required significant reduction of the severity. Therefore,
completely new EcoDry Scrubber system had to be considered. The system eliminates the need for
respirators and respiratory protection program. It eliminates the need for expensive activated carbon
filters to control VOCs. The new system creates different hazards (combustible dust), however, they are
so well controlled that the probability of explosion is negligible. Please see Sampling Data (EcoData blue
button).

Consideration of additional controls and determination of revised residual risk - Step 3 Tools 3a2, Process
FS2, Tool CH2, Tools 3b2, 3c2, 3d2, 3e2.

Note: Step 4 is not a required deliverable. However, it is included in the project to “measure the
effectiveness of the RA (ERA) process”.

ISO 22301-2012 and ISO 31010 tool B11 Business Impact Analysis (BIA) provide a more detailed
approach for safety and business objectives integration. For instance, BIA suggests that the RA team
should provide an agreed understanding of the identification and criticality of key business processes. In
addition, the inputs include financial and operational consequences of loss of critical process. In our case,
State Department of Health and Environment inspection that led to severe fines and they set strict
deadlines to complete the recommended corrective measures. We were also notified that if we continue to
release uncontrolled VOCs emissions, we’ll have to close the operations next year. It is obvious that
Bow-Tie analysis is a very good tool to present hazards, preventive barriers, mitigation measures and
consequences. In addition, the modified Bow-Tie diagram presents opportunities to include semi-
quantifiable risk level, consequences and color coding.

Completion of a risk register – Step 5: Tool 5.

Note: If the user changes any of the values in the RA Tool, they may change colors, financial measures,
or non-financial values. The tool is intended to be interactive.

One of the 8 ABET criteria for Safety programs requires the students to “demonstrate the application of
business and risk management concepts”. Selected final projects from this course, may be used by ABET
accredited programs as case studies and educational materials. I really hope that the participants will be
willing to share their final projects with educational institutions.

Thank you for the great course.

Georgi