Safety Science 157 (2023) 105918

Contents lists available at ScienceDirect

Safety Science
journal homepage: www.elsevier.com/locate/safety

The risk of risk assessments: Investigating dangerous workshop biases

through a socio-technical systems model
Deborah Hunt , Anjum Naweed *
Central Queensland University, Australia

A R T I C L E I N F O A B S T R A C T

Keywords: Organisations are required to manage industrial safety by implementing risk treatments to prevent hazardous
Risk management events. In the absence of objective failure data, risk estimates are generated in facilitated workshops that rely on
Risk assessment the judgement of diverse technical opinion from subject matter experts. These estimates generate the perfor­
Facilitation
mance targets for the engineering controls referred to in the Hierarchy of Controls embedded in work health and
Expert opinion and judgement
Hierarchy of controls
safety regulations. This novel study investigated biases within the context of facilitating risk assessment work­
Appetite for risk shops which can lead to understatement of risk estimates. Such biases can be dangerous and potentially difficult
Availability heuristic to prevent or mitigate. Interviews with facilitators and technical experts (N = 23) were conducted, with expe­
rience covering eight substantive industry sectors including oil/gas, mining, and chemical processing. Conven­
tional content analysis identified five biases at a group level and one at an individual level and ranged from
cultural or societal forces, industry norms, company pressures, as well as pressures associated with occupational
roles, and highly dominant individual views. These were mapped across Rasmussen’s (1997) socio-technical
systems model to identify potential mitigative/preventive measures that might improve risk assessments from
levels higher in the system. Practical implications and future research directions are drawn.

1. Introduction
Identifying and managing safety hazards in industrial operations is
an important legislative requirement. Such hazards are defined as “sit­
uations or things that have the potential to harm a person” (Safe Work
Australia 2019). Kaplan and Garrick (1981) describe hazards simply as
“sources” of potential loss. In an industrial context, hazards can include
working with tools, working at heights, machinery, chemical products,
thermal energy, nuclear radiation, dust, electricity, and so on. Where
hazards cannot be eliminated, legislation requires businesses to reduce
associated risks (e.g., Government of South Australia 2011). The notion
of hazard is distinct from that of risk, which in the industrial context,
comprises two fundamental elements: 1) the likelihood or probability of
a hazardous event; and 2) the associated harmful consequences of that
event. While concepts of risk with more elements and greater complexity
exist, this dual-element definition is most prominent in industry and
legislation.1
Hazardous situations often develop from failures of plant or equip­
ment (Center for Chemical Process Safety 2011b). As part of risk man­
agement decisions, plant operators need to understand the likelihood
and consequential severity (or impact) of these failures. Standard
equipment failure rates are published in reliability manuals, which can
be entered into complex modelling calculations to estimate risk. Alter­
natively, event probability and impact can be judged subjectively. To do
this, industries perform risk assessments2, using various tools including
risk matrices as depicted in Fig. 1a. With a deep understanding of sce­
narios, events can be located on a risk matrix containing guidance for
risk reduction. Organisations typically convene workshops to explore

* Corresponding author at: Appleton Institute for Behavioural Science, 44 Greenhill Road, Adelaide 5034, Australia.
E-mail address: anjum.naweed@cqu.edu.au (A. Naweed).
1
The dual element definition of risk is consistent with global industrial legislation, international standards, regulation for atomic energy, fire protection, and
process safety, and engineering texts (Centre for Chemical Process Safety 2022; Council of Europe 2022; Food and Drug Administration 2006; HM Government 2011;
International Atomic Energy Agency 2018; ISO/IEC Guide 51:2014(en) Safety aspects—Guidelines for their inclusion in standards; National Fire Protection Asso­
ciation 2022; Safe Work Australia 2019; Smith 2017, p. 386). The definition of risk also captures the understanding of risk as used by study participants in their daily
work.
2
The term ‘risk assessment’ is used broadly to refer to any kind of hazard identification or risk analysis with the purpose of identifying or designing measures to
treat risk.

https://doi.org/10.1016/j.ssci.2022.105918
Received 5 May 2021; Received in revised form 6 July 2022; Accepted 22 August 2022
Available online 28 September 2022
0925-7535/© 2022 The Author(s). Published by Elsevier Ltd. This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-
nc-nd/4.0/).
D. Hunt and A. Naweed
these scenarios where the team identifies potential hazardous events,
reviews causal mechanisms, estimates the likelihood of events, and the
severity of consequences (Aven 2016). This allows for risk reduction to
be developed. Apostolakis (1990) points to the importance of subject
matter experts to contribute their expertise and experience to this pro­
cess. The workshop team typically comprises vendors, designers, and
importantly, plant operators and maintainers. An expert facilitator
guides the process, collating the expertise, and recording the judgement
of the risk with and without reduction measures.
The traditional workshop approach set the scene for this study which
sought to identify biases connected with skewed estimates in risk
assessment. The next section provides a more detailed background, in­
troduces the underpinning theory, and formulates the research ques­
tions guiding the study.
2. Background
2.1. Risk assessment workshops: Errors & failures in facilitation
Workshop settings employ groups of people to collaborate, so factors
of a human nature naturally influence workshop outcomes. In a risk
assessment context, these human factors can lead to skewed estimates of
Fig. 1. (a) typical risk matrix used in risk assessment, and (b) illustration of the effect of skew on risk assessment.
2
Safety Science 157 (2023) 105918
either likelihood or impact. Skew reflects either overstated or under­
stated risk and this is shown on a typical risk matrix in Fig. 1b. High and
low skew are analogous to Type I (high) and Type II (low) errors in
hypothesis testing (Tabachnick & Fidell, 1989, p. 35). In this case the
hypothesis is the occurrence of the hazardous event with the unwanted
consequence. Type I errors occur when the workshop team incorrectly
judges the likelihood or impact to be high. This can result in unwar­
ranted risk reduction measures and an overly conservative approach,
such as onerous engineering interlocks or access restrictions. In contrast,
Type II errors are more dangerous resulting in insufficient risk treat­
ment. In this case, the workshop incorrectly judges the likelihood or
impact to be too low resulting in insufficient interlocks or an inspection
regime that is too infrequent.
Both Type I and Type II errors are somewhat mitigated through the
workshop method itself. Workshops bring together diverse expertise and
experience, and specialist technical facilitators balance and integrate the
opinions, seek consensus across the majority of team members and aim
to minimise residual uncertainty.
An expert risk facilitator keeps a workshop ‘on track’ by ensuring
that all voices are heard equally, arguments remain rational, and in­
formation is weighted appropriately. If they perceive an event likelihood
or impact has been judged inaccurately, they usually encourage
D. Hunt and A. Naweed
challenge. There are theoretically two failure modes associated with
this; either the facilitator fails to detect the skew, or they detect it, but
lack the agency to correct it. Whereas the non-detection of skew is
perhaps a simple reflection of the experience of the facilitator, the sec­
ond mode of failure is the concern of the present study and is known as
‘group bias’. This occurs when an opinion is held strongly by an influ­
ential or authoritative individual or sub-group, and objective informa­
tion is not available to counter the opinion. Group biases that result in a
Type II error are referred to herein as ‘dangerous biases.’
2.2. Bias & current approaches to bias mitigation in risk assessment
workshops
Paté-Cornell (1996) acknowledged the problem of bias among ex­
perts describing different ways in which to aggregate opinion in what
Aven (2020) refers to as a foundational discussion of risk analysis.
Montbeller and Von Winterfeldt (2015) defined two types of bias that
affect individuals and impact risk judgement. The first is cognitive bias
which occurs as a result of mental processes, described by Reason (1990,
p. 97) as cognitive operations which ‘default to contextually-
appropriate, high-frequency responses’. This means that in the
absence of new information, a cognitive routine is repeated more often
when it is deemed to be successful. The second category is motivational
bias (Montibeller & Von Winterfeldt 2015). This may be conscious or
subconscious, and is characterized by changes in opinion based on
external incentives such as social pressures, organisational environment,
culture, and self-interest (Montibeller & Von Winterfeldt 2015). Moti­
vational biases can permeate a workshop from the broader environment
to not only affect individuals but potentially whole workshop sub-
groups (e.g., vendors, designers, organisational representatives). Based
on extensive observations, Baybutt (2018) consolidated a list of cogni­
tive biases impacting risk workshops in process safety applications,
including: availability heuristic3, anchoring heuristic, confirmation bias,
conformity and peer pressure, framing effect, group polarization, groupthink,
representative heuristic and satisficing. Definitions of these terms from
Colman (2001) are given in Table 1. This list included biases tradi­
tionally considered to be motivational and recognised the influence of
the group on the individual. Hunziker (2019) examined biases in risk
management, and highlighted conformity bias and groupthink arising
from social or external pressures. These biases describe how one per­
son’s opinion can become the group’s opinion. The potential power of
such mechanisms can carry grave impacts for safety, for example,
groupthink is widely regarded as a factor in the Challenger launch de­
cision (Vaughan 1996).
Recommendations on bias mitigation in relation to risk have been
developed in various domains including business management (Hun­
ziker 2019; Montibeller & Von Winterfeldt 2015; Peace 2017), health
care (Ludolph & Schulz 2018), aerospace (Emmons et al. 2018), and
process safety (Baybutt 2018; Vaughen & Kletz 2012; Wickens et al.
2015). These include a greater use of statistics, training, team diversity
(Hunziker 2019; Montibeller & Von Winterfeldt 2015) and specific
facilitation techniques (Baybutt 2018). After examining the effects of
cognitive bias with an online survey, Peace (2017) recommended that
facilitators reduce subjectivity by implementing more visual aids, such
as flowcharts and pictures. While useful, these techniques restrict
themselves to the confines of the workshop and assign the responsibility
for bias awareness and mitigation with the workshop facilitator. An
exception to this is the work of Emmons et al. (2018) who created a
checklist for completion after the workshop to aid quality assurance.
Based on ratings of experiences with various biases from a cross-section
of 17 experienced engineers and managers, an 11-point risk evaluation
3
Heuristic: ‘A rule of thumb for making a decision, forming a judgement, or
solving a problem […] without any guarantee of obtaining a correct or optimal
result’ (Colman, 2001).
3
Safety Science 157 (2023) 105918
Table 1
Formal definitions for bias found in the literature (from Colman, 2001).
Bias Meaning
Anchoring heuristic An estimate by starting from an initial value and then
adjusting it to yield a final estimate, the adjustment
typically being insufficient and the estimate therefore
biased towards the initial value
Availability heuristic The frequency of an event is judged by the number of
instances of it that can readily be brought to mind
Confirmation bias The tendency to make estimates that confirm existing
beliefs, stereotypes, or prejudices
Conformity (bias) and Social influence, yielding to group pressure
peer pressure
Framing effect Changing a response to a problem based on changing
the problem’s description, labelling or presentation
Group polarization Group involvement causes the attitudes and opinions of
members to become more extreme, in the direction of
the predominant attitudes and opinions in the group
Groupthink A collective pattern of defensive avoidance,
characteristic of group decision making in
organizations in which group members develop
rationalizations supporting shared illusions of their
own infallibility and invulnerability within the
organization
Representative heuristic An estimate that A belongs to class B by judging the
degree to which A is representative or typical of B
Satisficing Searching through available options just long enough
to find one that reaches a pre-set threshold of
acceptability
and bias reduction checklist was designed (Emmons et al. 2018). The
checklist features various sector-specific sources of failure data with
which to cross-check risk estimates, but importantly, the potential in­
fluence of pressures external to the workshop are acknowledged through
reference to ‘socio-political forces.’
All other approaches to improve risk estimates tend to place the re­
sponsibility for quality with the facilitator in a model of linear cause-
and-effect (Goh et al. 2010). This is reasonable given the role of an
expert facilitator is to work with individual biases and locate common
ground and the diversity in workshops helps them to challenge single
points of view. However, the literature presented thus far and related
guidance for de-biasing assumes that the facilitator can: (1) detect the
bias as it is occurring; (2) understand the type of bias; (3) select an
appropriate de-biasing technique; and (4) implement it successfully
before it spreads to the group and skews the assessment. In addition,
reliance on the facilitator introduces the possibility of a common cause
of bias between the workshop group and facilitator where the facilitator
is not able to be impartial (e.g., an internal facilitator and organisational
pressures). Given that facilitators only have some control over final
attendance or diversity and may routinely deal with underlying pres­
sures going into the workshop (e.g., restricted stakeholder availability),
this raises questions as to whether the level of reliance on the facilitator
(individual-level focus) is reasonable and whether a broader systems
focus is needed.
2.3. Bias mitigation in risk assessment workshops through a systems
framework
One of the most influential systemic approaches to risk is Rasmus­
sen’s (1997) socio-technical risk management model (see Fig. 2). This
model has been widely used to investigate plant management and
identify causal mechanisms of industrial accidents (Leveson 2004). It
prompts consideration of the role played by six socio-technical levels of
responsibility in the propagation of events leading up to an accident and
enables both a top-down approach based on areas of control, and a
bottom-up summation of discipline-specific sub-models such as devel­
oping a simple event timeline or considering the “5 whys” (Serrat 2017).
At a Company level, then, viewing risk management from this
perspective promotes the distribution of plans and policies throughout
D. Hunt and A. Naweed Safety Science 157 (2023) 105918

Fig. 2. Socio-technical model of risk management (adapted from Rasmussen, 1997).

the organisation, enabling more sustainable risk management, and
reducing blame culture (Hopkins 2005). The typical risk assessment
workshop takes place at the (Asset) Management level or below where,
for example, a plant to be upgraded or a new item of equipment is
assessed. In theory, external pressures that create group biases could be
sourced from any level of the hierarchy, given that actions and decisions
can interact with one another across the levels to shape behaviour. By
gaining knowledge of what these biases are, and from where on the
socio-technical model they originate, the level at which to effectively
treat these biases can be identified. This unique view of biases aims to
look beyond asset-level facilitation to the broader system hierarchy for
support with risk assessment.
This approach can be reviewed in the context of the Hierarchy of
Controls: a system for controlling workplace risks that is mandatorily
applied both in Australia and New Zealand (e.g., Health and Safety
Executive 2021; Peace 2017; Safe Work Australia 2011; The National
Institute for Occupational Safety & Health 2021). The National Institute
for Occupational Safety and Health 2021). Under this system, reliance

Fig. 3. Location of facilitation and methodology of risk assessment workshops under the Hierarchy of Controls system.

4
D. Hunt and A. Naweed Safety Science 157 (2023) 105918

on individuals and/or procedures is considered among the least effective
of risk treatments (see Fig. 3). Controls that are based around elimination,
substitution, and engineering are viewed more effective than administrative
controls by increasing orders of magnitude. In applying this to risk
assessment workshops, a reliance on an individual (i.e., facilitator) is a
strictly administrative control. It is impossible however to eliminate
dealing with risk, and so application of a systems framework seeks
rather than to change the way facilitators work, but to change the way
the system works that is managing the facilitator.
2.4. Aims & objectives
(SD = 10.42) in a range of 12 to 48 years. This sample size was
considered sufficient to exceed thematic saturation (Guest et al. 2006).
The gender profile of the sample was 20 males (87%) to 3 females
(13%); this was representative of the industry, with published data
reflecting 89% males and 11% females employed as engineers in
Australia (Professionals Australia 2017)). A detailed decomposition of
participant demographics is given in Table 2. A simple occupational
Table 2
Participant demographics, work experience and industry representation.
Demographic Category Industry/Professional Role

This study examined the traditional workshop approach to identify Ind. Eng. Prin. Dis.
dangerous biases associated with falsely skewed estimates in risk Cnlt. Mgr Eng. Eng.
assessment across a range of industrial sectors. In line with the foregoing Gender Female - 1 2 -
discussion, group biases were considered particularly challenging for Male 14 1 3 2
1
facilitators. The objective was to identify dangerous biases, identify the Age range < 50 - 1 2 2
50 – 59 4 1 1 -
source of the bias on Rasmussen’s (1997) socio-technical model, and use > 59 9 - 2 -
the model to nominate an appropriately independent level of manage­ Work experience < 30 2 - 2 2
ment as a countermeasure. The research questions guiding the study (years) 30–39 5 1 3 -
were: 40–49 7 - - -
Familiarity with Off-site formal risk
RQ1. Which biases are difficult for facilitators to manage in a risk
risk assessment estimates:
assessment workshop, with the potential to falsely understate risk methods2 - with workshops3 28 3 11 3
estimates? - without 10 1 2 1
RQ2. What levels of a socio-technical system model correspond with workshops4
the sources of bias in a risk assessment workshop? Off-site hazard 3 1 - -
analysis with
RQ3. What levels of a socio-technical system model, if any, are suf­ workshops5
ficiently independent of the bias source that they might counteract the Informal site methods6 1 - - -
bias? Number of formal < 20 3 1 3 1
facilitations7 20–100 or “many” or 7 1 2 1
“for several years”
3. Method
> 100 or “>10 years” 3 - - -
Industry sector Oil and gas, chemical, 7 1 4 -
3.1. Study design petrochemical
Mining, minerals 3 1 2 1
A qualitative orientation adopting semi-structured interviewing processing
Rail, driverless and 2 - 1 -
techniques was used to elicit observations and experiences from risk semi-automatic rail
assessment workshops. This was selected in view of similar designs that Energy, power 2 - - -
have explored issues of importance to personnel with specialist skillsets generation
(Asilian-Mahabadi et al., 2018; Körner et al., 2019; Naweed et al., Manufacturing – 2 - - -
automotive, plastic
2018b,a; Naweed and Kourousis, 2020; Naweed and Murphy, 2022;
compounding
Taylor et al., 2019). An interview methodology was favoured over a Defence 1 - - 1
formal survey because it: (1) generated more narrative than could be Mobile machinery, 1 - - 1
recorded by survey for the same time imposition to participants; (2) heavy industrial
captured natural language and intonations of facilitators signifying Building and utility 1 - - -
construction
important points; and (3) permitted creation of new themes given the
extensive knowledge and experience of participants. Data were collected Note: Ind. Cnlt. = Independent Consultant; Eng Mgr = Engineering Manager;
June to July 2020 in Australia and as restrictions around the COVID-19 Prin. Eng. = Principle Engineer; Disc. Eng. = Discipline Engineer.
1
pandemic had taken hold of working practices, interviews were all One participant did not provide their age.
2
conducted virtually. Methods were nominated on data card.
3
Methods indicated: Layer of Protection Analysis (LOPA); Non-LOPA Safety
Integrity Analysis; Functional Safety Assessment; Design Review; Bow-tie
3.2. Participants & recruitment
Analysis; Event Tree Analysis; Fault Tree Analysis; Safety in Design; Hazard
and Operability Analysis; Human Risk Number; Structured What-If Analysis;
Participants were recruited through advertisement on an online Business Impact Analysis. Methods undertaken early in design may undertake
platform administrated by Engineers Australia (EA).4 Purposive sam­ only broad risk estimation (Center for Chemical Process Safety, 2011a, 2011b;
pling was used to obtain a sample within a specific domain of compe­ ISO/IEC, 2009).
4
tency and skillset. The advertisement called for full EA members Methods indicated are typically performed as software calculations using
experienced in risk assessment, excluded student members, and objective failure data: Failure Mode and Effects Analysis; Failure Mode Effects
encouraged participation from experts in both facilitation and risk and Criticality Analysis; Reliability Centred Maintenance; Reliability, Avail­
analysis, including engineering technologists who may have been highly ability and Maintainability; Quantitative Risk Analysis; Weibull Prediction; C2
(Center for Chemical Process Safety 2011a; ISO/IEC 2009).
experienced tradespeople but did not possess degree qualifications. 5
Methods indicated: Hazard Identification exercises. These are usually under­
A total of 23 participants consented to interviews. The average age of
taken too early in design for risk estimation but may perform a preliminary
participants was 55.6 years (SD = 11.36) and ranged from 32 to 70 hazard ranking to identify potentially severe consequences.
years. The sample had an average professional experience of 32.7 years 6
Usually a qualitative risk estimate involving a small group and performed on
site such as Job Safety Analysis, Toolbox Talks, Task Hazard Analysis (ISO/IEC
2009).
4 7
This is the largest professional engineering institution in Australia. One participant declined to complete this item.

5
D. Hunt and A. Naweed Safety Science 157 (2023) 105918

taxonomy was used to describe the role and professional hierarchy of Table 3
participants: Independent Consultant, for individuals working as spe­ Overview of the interview protocol.
cialists; Engineering Manager and Principal Engineer for highly expe­ Topic Example Content Example questions
rienced engineers, one working with more direct reports, one focussed and prompts
on technical function; and Discipline Engineer for a less experienced 1 General experience in Background, current role, “What is your history in
engineer. relation to risk rapport building, history relation to risk
Of the sample, 69.5% had over 30 years professional engineering assessments of risk assessment, current assessments?”
experience, and 60.8% were consultants. For these participants, risk industry standards “What’s your
involvement in your
assessment, and in some cases, professional facilitation, was part of their current role?”
core service provision. One consultant estimated facilitating over 600 2 Familiar risk Typical methods and “Are there any other
workshops; another had been facilitating for over 10 years. Three par­ assessment methods experience in relation to types of assessments
ticipants indicated during interview that they had provided expert tes­ roles in workshops, you’ve been involved
personal stories of safety in?”
timony in a court of law. Engineering disciplines ranged across process,
incidents
civil/structural, electrical, mechanical, mechatronic, instrumentation 3 Broad workshop Personal stories, issues “In these workshops, can
and control, automotive, systems and process safety. All but four par­ experience (may or that cannot be mitigated, you tell me what works
ticipants had worked overseas. The regions were South East Asia, the may not include influences, impact of and what doesn’t work
Middle East, Western Europe, and China. All participants but one lived observations of bias) changing standards so well?”
“When is facilitation
and worked in Australia; the exception was in Hong Kong. The sample difficult?”
held significant expertise and experience in risk assessment techniques 4 Biases in workshops Specific biases, effects on “What are some of the
and workshops across a range of disciplines with exposure to interna­ and their influences people, workshop and human factors issues
tional businesses and cultures. estimate, personal stories you’ve seen in
of how situations within workshops?”
The industry sectors represented included both light and heavy in­
workshops were managed
dustries, and as such, experience assessing a broad range of risk levels 5 Broader issues related Workshop management “How did some of these
was available. Oil and gas, mining and chemical/petrochemical are more to risk assessments in general, culture, issues effect the
likely to be subject to rare events with severe consequences involving organisations, societal workshop?”
multiple personnel. Continuously operating machinery in manufacturing risk, standards
6 Other information Concluding remarks “Is there anything else
and minerals processing, involves more frequent risk events but with the
you would like to
impact restricted to individuals in proximity to the equipment. All the mention?”
industries represented utilise workshops as a part of the methodologies
listed in Table 2 except building and utility construction which typically
uses more informal risk methods such as checklists or brainstorming. formulated but grounded within data, with labels for some codes (e.g.,
This inference was based on recollections during interview and is indi­ bias type) drawn from literature. Similar to the approach given by
cated in Table 2 as “informal site methods”. The sample represented a Moldavska and Welo (2017), analysis followed the phases described by
cross-section of industry applications and had experience with different Bengtsson (2016); these were (1) preparation, (2) organization, and (3)
types of hazards and levels of risk. reporting, however, a further phase (4) critical examination, was inte­
grated to address research questions RQ2 and RQ3. To convey the
3.3. Ethical considerations trustworthiness of results (Bengtsson 2016), the four phases are
described next.
Participant identifying information, company names, the names of
operating assets and country/region names were redacted from inter­ 3.5.1. Preparation phase
view transcriptions. Provision of age and gender information was Following data collection, the preparation phase covered making
optional, and no information about the employer was collected. The sense of ‘data as a whole’ (Elo et al. 2014). The unit of analysis was a
study met the requirements of the human ethics committee of Central coded observation of bias deemed sufficient to influence a risk estimate.
Queensland University (Approval no. 2020-065). In alignment with study aims, the analysis looked for biases that un­
derstated risk and were considered potentially difficult for a facilitator
3.4. Procedure manage.

After registering their interest, participants received an information
sheet, consent form and data card via email. Documents were completed
and returned prior to interview via email with consent reconfirmed at
the start of the scheduled session. Each session took approximately 90
minutes to complete and depending on participant preferences, was
conducted using either the Zoom, Skype or Webex videoconferencing
platforms. Table 3 provides an overview of the interview protocol with
example questions and prompts. Interviews commenced with rapport-
building questions, and gradually built towards discussion of experi­
ences with biases in workshops and their influences. Each interview was
audio-recorded for later transcription.
3.5. Data Analysis
Transcribed interviews were imported to NVivo (Ver. 13, Release 1.3
(5 3 5), QSR International). Content analysis and data categorisation was
undertaken to enable interpretation of the underlying meaning of points
being made (Graneheim & Lundman 2004; Naweed et al. 2022). This
was performed inductively, meaning that categories were not pre-
3.5.2. Organization (of Data) phase
Data were elicited as stories/recollections of various biases and their
impacts on workshop outcomes. Data were either manifest or latent
(Graneheim & Lundman 2004); manifest data were obvious and existed
at a surface level, whereas latent content required deeper interpretation
of the underlying meaning. These forms of data were coded and ana­
lysed to identify a suite of biases using the protocol summarised in Fig. 4.
Three steps were associated with this (and transitioned into the critical
examination phase) as follows:
(1) The mechanism of influence on the risk estimate (emerging
inductively from latent content) was categorized as Skew. Skew
described a direct quantitative effect on the risk estimate through
either event likelihood, or consequential severity. The direction
of skew (understatement or overstatement) was coded. For some
bias types, observations in both directions were noted (e.g.,
Availability Heuristic and Organisational Confirmation Bias). Stories
associated with risk understatement were retained and stories of

6
D. Hunt and A. Naweed
Fig. 4. Analysis process used to code, categorise and identify biases in collected data.
overstatement or with no clear direction of skew were not
considered for further analysis.
(2) The level of influence of the bias brought forward from analysis
was categorised based on whether it was exhibited at the Group
or Individual level. Where bias impacted several members of the
workshop team or was exhibited by an individual who was an
authority figure, this was deemed potentially beyond the ability
of the facilitator to objectively manage. This was also considered
to be the case if the facilitator was identified as the source of the
bias. Influence of bias at an individual level was only considered
if it was raised as difficult to deal with.
(3) Data were initially coded for bias type using labels drawn from
Baybutt (2018) and Hunziker (2019) (RQ1).
3.5.3. Critical examination phase
The biases with group-level influence that emerged in the organi­
sation phase were critically examined and identified for their source by
coding them against Rasmussen’s (1997) socio-technical model (RQ2).
Labels were then refined depending on source and level of influence. For
example, individual instances of adherence to previously held beliefs
7
Safety Science 157 (2023) 105918
was coded Confirmation Bias whereas the same effect observed by mul­
tiple workshop members from the same organisation was coded
Organisational Confirmation Bias. Consideration was then given through
general discussion to how organisational sources higher in the system
could practically intervene to prevent bias that is, how dangerous biases
could be ameliorated at a system-level (RQ3). This produced a set of
recommendations for Moldavska and Welo’s (2017) reporting phase.
3.5.4. Reporting phase
The Results and Discussion section is synthesised to describe the
content analysis and critical examination, together with a General Dis­
cussion section that follows. Supporting transcript excerpts are given to
support the content analysis via an anonymous ID-tag in parentheses
where “(P_#)” indicates “(Participant_number).” Descriptive statistics
related to overall representation of coded categories are also provided.
The considerations of bias sources and workshop management are also
reported in Results and Discussion as prose.
D. Hunt and A. Naweed
Table 4
Data abstraction and emergent biases with influence that skewed risk estimates towards understated risk.
Level of Influence Bias type
Group Organisational Confirmation Bias
Occupational Roles
Cultural/ Corporate Appetite for Risk
Availability Heuristic
Corporate Direction
Individual Authority Figure
4. Results & discussion
The overall results of the study are abstracted (Elo et al. 2014) and
shown in Table 4. A total of six biases emerged to understate risk. Of
these, five were coded at a group level of influence (39% representation),
and one was coded at an individual level. Of the five group-level biases,
four arose out of external pressures: Occupational Roles, Cultural/
Corporate Appetite for Risk, Corporate Direction, and Organisational
Confirmation Bias. The remaining bias (Availability Heuristic) while
arising at an individual level, was observed as a group-level phenome­
non. A single bias (Authority Figure) was observed in individuals that
influenced a workshop towards false understatement (e.g., through peer
pressure). Results are discussed in the next sections, using excerpts from
the data with participant identification tags to support data where
relevant.
4.1. Group biases
4.1.1. Organisational Confirmation bias
Indications of confirmation bias in a group from the same organi­
sation were coded as Organisational Confirmation Bias. This bias was
characterised by the tendency of employees to seek out or create data
supporting previous actions that had been taken by an organisation. It
was identified in the workshop team through influence of project
managers who were felt to resist challenging design decisions in case
they impacted project cost and schedule. It was also a characteristic of
design groups, such as vendor representatives, who were perceived to
resist challenge for the same reason:
There is obviously very much a bias to stay with - what we have got is
fine, and we do not want to do anything extra, steering the results to
show that, basically back up to the point we’ve come to already. That
is the most common one I have seen. (P_7)
The following quotes also demonstrate the role of certain authority
figures in contributing to organisational confirmational bias:
There’s generally a lot of inertia, whether it’s [a] design team that
doesn’t want to have to go back and rework their design or a project
manager that doesn’t want to spend any money or just wants it out
the door because they’ve got KPIs5 to meet. (P_13)
We have had HAZOP’s6 for an FPSO7. This was in [a country] where
we had the project manager come in at the start of HAZOP. He said,
“But unless you find anything that is going to sink this FPSO or is
going to catastrophically blow-up everything, I do not want an ac­
tion.” He left the room. (P_23)
The prospect of implementing design change creates a conflict of
5
Key performance indicators: various targets/goals that organisations aim to
achieve.
6
Hazard and Operability Analysis: a common risk assessment method in
process industries (Center for Chemical Process Safety 2011a).
7
Floating Production Storage and Offloading facility.
Safety Science 157 (2023) 105918
Participants, Frequency of statements Total representation
N
12 16 (37%) 39 (91%)
7 8 (19%)
8 6 (14%)
3 5 (12%)
4 4 (9%)
4 4 (9%) 4 (9%)
interest in design teams in risk workshops. This raises questions or
concerns as to why those risks have not already been designed out, with
implications that the design team has overlooked a hazard control. This
potentially undermines their competency.
A prevalent view was that an absence of hazardous events related to
a particular design was indicative of a design meeting its performance
requirements. In these cases, organisations were perceived to seek to
confirm an existing design:
Organisations rarely want to categorize any of the injury types as
fatalities or multiple fatalities […] particularly organisations that
have never had or have not had within their reasonable life memory,
any fatalities. Very, very reluctant to talk about fatalities. (P_4)
A tendency to under-report maintenance issues in one particular type
of operation (offshore) was described, hinting at broader motivations
influencing the workshop:
The difference between onshore and offshore applications is huge.
Part of it is the more corrosive environment offshore but also I think
usually there you know they are extremely conscious of the manning
levels and they have less operators than you would have in an
equivalent system onshore. And because of that maintenance and
things are not done as well offshore. But that’s never, nobody ever
wants to admit that at a HAZOP, “Ah well […] offshore our main­
tenance isn’t going to be too good”. That’s very much a human
factor. Not only in the lack of maintenance offshore but somebody
not wanting to admit that in a HAZOP or design review. (P_2)
Organisational safety targets, such as KPI’s for near misses, were also
considered to exert pressure on personnel. By not reporting near misses,
facilities or plants were perceived to be safer than they actually were.
Such beliefs were felt to permeate risk assessment workshops:
We often have a zero KPI for near-misses, and I think that is bad
because it is pushing reporting underground because no-one wants to
record a [potentially fatal] near-miss. (P_7)
Some participants perceived that some of the attendees at workshops
did not possess substantive knowledge or expertise. This was seen to
result in reduced emergence of new risks. Unless the facilitator was able
to repeat the workshop with new personnel, which was an unforeseen
cost and consequently not always possible, then this meant fewer
changes to the incumbent design:
It is not unusual for existing plant that people do not actually know
how it works, or they do not know fully how it works, or they do not
know the reasons why something was designed the way it is and that
can be a problem. (P_6).
We had five vendors from around the world coming to this HAZOP.
So this was not one, but this was many of the vendors. We had one
vendor from [an overseas country]. He came in, and we started going
through his package. This is a team thing, that the teams had kept on
probing and the guy eventually threw his hands up in the air. He said
“Sorry. I am a salesman. I was given notice that I had to attend this
HAZOP. I cannot answer your questions.” So we sent the guy home.
8
D. Hunt and A. Naweed
Another vendor and this was from [an organisation] from [an
overseas country]. [..] There were five of them I think. And it was a
similar situation [..] We started probing about the control system and
they just did not have the answers. So they had their great team in
certain areas but the area we were interested in they said no. We sent
them home. So five people from [an overseas country] we sent home.
And we said “Sorry but you’re going home. We will come to [your
overseas country], we will come to [your city in your overseas
country] and we will repeat it. And literally we went back as a team
to [their city in overseas country] and we repeated the HAZOP.”
(P_23).
Participants described risk assessment exercises as becoming routine
confirmations of what was already there:
People feel they have to identify hazards so they will come up with
stuff that really is not very meaningful or is routine, a routine hazard
because they feel they have to write something down. (P_8).
The bias I found was that the operations people did not have the
experience, they did not know what risks they were taking, and they
just simply said, “Ah, we have got one there. We will have another
one here.” (P_18).
What I see, what gets my back up at different times is sometimes it’s
like “oh, we’ve done risk assessment on this machine, this one is
similar so let’s duplicate that one.” (P_3).
The latter quote highlights some participant frustration in dealing
with workshop members who display a resistance to engage with the risk
assessment process in a meaningful way. One participant described the
potential impact of this behaviour as “you got potential to miss some­
thing important” (P_16).
4.1.2. Occupational roles
The bias of Occupational Roles shares some overlap with Organisa­
tional Confirmation Bias but also has some distinction in that it comes
from the professional role of the workshop participant as opposed to the
broader organisational policy or direction. Some risk assessment work­
shop attendees may, for example, have professional roles that ostensibly
motivate them to protect a budget, or to ensure design integrity. In
relation to safety, these two may present as opposing forces and are
exemplified through the roles of the Project Engineer/Manager and the
Discipline Engineer, where each role is required to protect different
aspects of a project. Participants perceived risk understatement to occur
when cost considerations took priority over engineering:
The project manager, they kind of got blinkers on8 as to what they
want to achieve. They just want to get the project up and running on
budget, on time. (P_12).
When I am facilitating, I will find these two diverging views – the
vendor stating that the [risk event] probability is very very low, and
the operations’ people saying, “No. It is far more frequent than that.”
(P_18).
I have also seen that other type of bias where you have got the project
engineers there and obviously, they don’t want to be told that the
design has got some flaws. (P_7).
In the latter quote, the term “flaws” was given to describe scenarios
where the design was considered to have not adequately treated risk.
This may be linked to the number and mix of participants in a risk
assessment workshop in any given day, impacting on the veracity of risk
estimates. Given the role of the facilitator, there may be little within
their power to mitigate potential impacts of this scenario once the
workshop is underway, and while they may have agency to request
equal numbers of both project and engineering personnel to create a
8
“got blinkers on” is an English expression to describe a person having a
narrow point of view and not taking other people’s opinions into account.
9
Safety Science 157 (2023) 105918
balanced mix, the knowledgeability and sensibilities of individuals are
out of the facilitator’s hands. This points to an inherent fallibility in the
workshop methodology itself.
In some cases, allocating designers to the role of facilitation was
considered to influence an entire workshop group:
Even for experienced facilitators, they tend to be biased, […]
enforcing what [the facilitator] thinks is right. Now, it happens more
for those process engineers who have been involved in the design
process and if they happened to be picked up as a facilitator […] then
it is [their] own work being critiqued. (P_11)
As reflected in this example, influence on the workshop group may
arise from facilitator’s own authority as a designer and their ability to
speak to the design aspects. However, criticism for a design may also be
interpreted as undermining their credibility as a designer and this may
contribute to bias.
4.1.3. Cultural/Corporate Appetite for risk
Risk appetite describes the tolerability of risk, or the effort that an
organisation is prepared to go to in order to manage risk. When the
tolerance for risk slowly increases over time, this corresponds with “risk
creep” or “risk normalization” and links with habits formed from living
with risk over time (Vaughan 1996). In the context of risk assessment
workshops, normalisation manifests as a reduced sensitivity to hazards
that are constantly present but have not yet resulted in an incident. Here,
the normalisation was linked with understatement: “When we experience
things every day, it becomes normalized and we do not see it as risk
anymore.” (P_7). One participant described two legal cases where they
perceived an industrial site to have grown accustomed to working at a
level of risk that resulted in a fatality:
[Organisation A] killed somebody a 29-year-old man […] the
investigation made a point of saying that they knew the risk was
there, and they knew the cost was trivial, but they were so accus­
tomed […] to working in an unsafe situation, even though they knew
what the risks were and that, they were comfortable [with the risks].
(P_19)
[Organisation B] had identified there was a high voltage power
cable. Like on a giant chain, no worries, everybody knows that power
cable. Of course, when the backhoe driver is killed, and in the
investigation, the question was, “Oh, you knew there was a power
cable there, could you have isolated it at a reasonable cost?” The
answer was “Yes, it would have been easy to isolate. There was no
particular inconvenience in isolating it.” That is why they are found
guilty because they had accepted a risk and the cost of treating that
risk was trivial. (P_19)
Another participant who dealt with risk assessment daily, perceived
that low level risks with outstanding actions related to risk treatment
were eventually thought of as “noise” and it was common to tolerate low
risks and lose sight of them adding up: “Each decision on its own is okay,
but when you put five of those together, this is not okay.” (P_20). In line with
this, a subconscious component to bias was considered to make it
difficult for workshop attendees to perceive events as hazardous:
They do not even perhaps recognize some situations as inherently
risky because they are working in a certain way that accounts for
that. And it is almost subconscious, really. (P_16)
Lastly, the local culture or government jurisdiction (i.e., where the
plant was located) was also considered to influence bias and appetite for
risk within a workshop:
I found [culture] to be a big influence. I think, if you are going to
work and you [are] normally seeing people in motor accidents and
you have like your acceptance of death and injury is just going up
with that level of consequence. (P_10)
D. Hunt and A. Naweed
4.1.4. Corporate direction
Participants indicated that the influence of corporate direction was
characterised through actions during or after a risk assessment work­
shop that appeared to protect corporate interests. For example, use of an
authority figure to approve risks deemed to be high was perceived by
some as working under the threat that their work would not be signed
off:
I have seen a couple of awful situations where an organization is set
up and it said something like any risk that is high or greater, needs to
be signed off by senior managers. And so, the behaviour that people
followed was to make sure that all risks were less than high, because
getting senior managers to sign anything off was somehow embar­
rassing, awkward, or difficult. That was really bad, because then
people are not thinking straight. (P_8)
One participant talked about an organisation manipulating risk
contours on a plant layout. These are lines that differentiate areas that
expose plant personnel to different risk levels and are usually derived
from explosion diameters (Johnson 2010). The implication drawn here
was that organisations changed the contours to align them with the risk
treatment already in place to avoid new costs. One participant expressed
in some dismay that this behaviour effectively overrode the outcomes of
the workshop:
We have seen risk contours which should be circular. They get to the
boundary of the property and they become square. Does not matter
how you cut it. Somebody has fiddled the books to get the numbers
right. And it is a bit sad, but it does happen. (P_23)
The importance of cost for certain parties was commonly observed as
resistance to any risk treatment that increased expenditure:
The [group] never said anything. They were the contractors. They
never said anything unless it was going to have an effect on cost, and
when it did, they were in there like a ton of bricks going. “No, we do
not want this.” […] They did not like that at all. (P_6)
One participant working as a facilitator was directed by an organi­
sation not to find any risks that required expensive risk treatment:
Sometimes [the organisation] come to you and they said no [to high
integrity equipment] on this site. You need to do the workshop with
no [high integrity requirement]. (P_15)
In this scenario, a facilitator has very little agency as the organisation
may simply seek out a replacement facilitator to comply with their
requirements.
4.1.5. Availability heuristic
Availability Heuristic is defined as the ease with which information
can be recalled whereby easier information to recall is judged as more
frequent (Pachur et al. 2012; Tversky & Kahneman 1974). In the context
of risk assessment workshops, the was reflected in scenarios where
multiple people had no prior knowledge of a recent incident, or had
forgotten about it. For risk understatement, the workshop group was
considered to falsely believe the incident occurred with less frequency:
They might have thirty scenarios that might lead to a collapse, but
the one that has actually happened is suddenly, the real one. The
other ones which when you look at them more quantitatively are
actually just as likely, but that particular thing has not happened
before, they tend to get down-played a lot. (P_7)
Indeed, events that had not yet happened were seen to lose
credibility:
Probably, the most common thing that you get people arguing about
is things like very low probability type events. People go and look,
this is just so unlikely. So high consequence low probability. They are
always a bit problematic because people do not—they prefer to
10
Safety Science 157 (2023) 105918
sweep it under the carpet and go “it is so unlikely that it is not going
to happen”. (P_6)
Another participant recalled a fatality that occurred over a decade
ago (in 2008) that had the effect of prompting new risk assessments
across organisations in its industry. After some time, however, the in­
dustry “forgot” and in 2020, the risk protections in place at a nearby site
were perceived to look just as inadequate as those in place prior to the
fatality. After many years without incident, the participant perceived
that the industry had relaxed their risk treatment:
So all of a sudden, everyone wanted to do risk assessments on these
bins [..] And now here we are to 2020, a year ago, I did a couple of
jobs for [an industry], a couple of hours from where that incident
occurred and they were back to 2008 in that they want to do the
same things as what had happened or the precursors to what had
happened in that event. (P_19)
Thus, the availability heuristic relayed here was considered to
operate at an industry level, skewing assessments in response to events
followed by a period of complacency. Twelve years without an incident
was thus considered to have created an inaccurate judgement of risk
despite the severity of the potential consequence.
4.2. Individual biases skewing to understated risk
4.2.1. Authority Figure
Participants perceived that, in most cases, a display of bias in risk
assessment workshops involved overstatement rather than understate­
ment of risk. These instances were viewed to be largely manageable, but
where an individual held a position of authority or was a particularly
dominant figure, such circumstances presented facilitators with diffi­
culties. The perceived power of groupthink or the desire for conformity in
the presence of a dominant individual was conveyed:
Groupthink really is an issue, certainly with dominant characters. I
personally find that the groupthink is worsened by risk ranking
because perceptions about risks are so diverse. If you have got a
dominant character who convinces the group that it is a low-risk, and
then the group goes with it as a low-risk. Therefore, nothing much
needs to be done about something. It takes a really good facilitator to
bring the group out of that, and possibly you cannot. (P_8)
Some participants thought that individuals who represented
specialist manufacturers tended to provide assurances that risks asso­
ciated with their equipment were lower than they actually turned out to
be in practice:
I can think of one that was a project we did for a gas company where
we actually did have a failure years down the track. [..] We’re talking
several million dollars. [..] There was a failure in the same exchanger
on two separate trains. One of them was a lack of quality control
during fabrication and the other was a design fault. Because when we
were talking about it at the design stage with the exchanger manu­
facturer [..] have you made these exchangers before? Yes, yes, yes,
here’s our reference list, you know we’ve done a lot of these ex­
changers before. When we were probing after the failure, after the
design failure, we found that well actually we used a slightly
different design in this one and we haven’t actually made one exactly
like this before. (P_2)
More often than not, there are not many equipment suppliers, there
are only about a handful I know of about six or seven people who
supply this type of equipment. And they say, “No. No. No. We have
supplied hundreds and hundreds of them. We have never encoun­
tered this.” (P_18)
Finally, facilitators were also seen to overtly dispense with their
impartiality and use the authority of their workshop role to impose their
own judgement of risk:
D. Hunt and A. Naweed Safety Science 157 (2023) 105918

I have seen actually one of the worst assessments I’ve sat in where the 4.3.1. Biases from an asset level within a company
facilitator had quite a bias about what, again, a previous design. The Based on the narrative derived from interviews, attendees at risk
facilitator had quite a bias for what he thought the outcome should assessments who were perceived to display the Occupational Roles and
be, and he had fifteen people telling him, “No. This could happen.” Organisational Confirmation Biases were considered to be operating in
He just did not want to write it down. That was quite mind-blowing. I accordance with their role; thus, a designer was there to defend the
had to pretty much raise some concerns afterwards. It was an exer­ design and the project manager was there to reduce costs. Measures to
cise of having a bunch of people in the room to agree with his control these biases may therefore need to be selected from higher levels
opinion. (P_7) of the model, in this case, from the company. Company policies or in­
ternal work instructions/procedures/standards for governing risk man­
The majority of responses to authority figures were not directly
agement processes can dictate multi-discipline and multi-stakeholder
associated with the false skew of risk in either direction. A presence of
design reviews sufficiently early in design processes to allow for
authoritative individuals tended to result in a loss of contribution to the
maximum flexibility and tolerability to design options. Company policy/
workshop whereby team members felt silenced at worst and became
procedures may also instruct the involvement of personnel from outside
passive at best. This behaviour could skew the estimate in varying
of projects to participate in risk assessments and provide impartial
amounts and in either direction, depending on how the withdrawal
feedback. The higher the potential risk, the more independent this re­
changed the relative mix of the workshop and the specific view of the
view should be.
authoritative individual.
4.3.2. Biases from a company level
4.3. Critical Examination: Sources of bias & implications
To manage Corporate Direction and Corporate Appetite for Risk, the
model points to regulation and codes of practice from the industry (i.e.,
The results of mapping identified biases at their source on Rasmus­
Regulators, Association level). Regulation has the potential to hold
sen’s (1997) socio-technical model are shown in Fig. 5, showing the
companies accountable by drawing comparisons with equivalent oper­
broad context from which workshop influences came, drawing impli­
ations or contexts found elsewhere; however, regulators seldom have the
cations and directing where improvements might originate from. If so­
resourcing or capacity to explore individual risk assessments in detail.
lutions were to be generated to minimise workshop biases, rather than
This means companies carry the responsibility to establish their own
simply looking to the facilitator or any other solution within the work­
levels of risk tolerance. This is particularly the case in jurisdictions like
shop methodology itself, system levels above and independent of the
Australia where legislation does not mandate maximum residual risk
bias were preferred. Looking to these levels for solutions may minimise
levels beyond what is “reasonably practicable”. This is a key reason why
common factors between a potential solution and the bias to which that
companies tend to involve facilitators with cross-company experience to
solution is applied. For example, a company work instruction mandating
facilitate their workshops. However, this study reveals that terms of
a particular risk assessment procedure is just as likely to be influenced by
reference can be written for workshops which essentially negate the
a company-level bias as the risk assessment itself. Companies may
facilitator’s experience (eg., by removing scope from the assessment). In
therefore be blind to the effects of their own biases, thus a solution from
these scenarios, the responsibility falls upon facilitators (i.e., a person/
the industry or association in which the company operates is more
administrative component within the system) to do all that they
suitable. As an alternative, a company might produce an effective work
reasonably can in order to maximise objectivity. Thus, practical con­
instruction for risk workshops while being aware of their company-level
siderations such as the regulation of industrial risk facilitation, including
biases, and moderate this with an independent review of the work in­
a code of ethics and the sharing of de-identified risk data, may be
struction at industry level.
necessary to support and protect both facilitators and the companies
The bias Corporate/Cultural Appetite for Risk was split across the
who provide their services. Developing and implementing certification
model based on whether the source was cultural (government level) or
for practising industrial facilitators and requiring continuing profes­
corporate (company level). The Availability Heuristic and Authority Fig­
sional development and minimum levels of practise may be a
ures biases were deemed to have no single source on the model as they
consideration.
were considered a fundamental human factor. Consequently, these were
sourced at all levels of the system as such individuals can work
4.3.3. Biases from society or culture
anywhere.
Cultural Appetite for Risk was deemed to sit at the top (i.e., Govern­
ment level) of the socio-technical model and informed by public policy

Fig. 5. Risk assessment workshop biases mapped onto Rasmussen’s (1997) socio-technical model based on their source.

11
D. Hunt and A. Naweed
and societal norms. For companies with a global footprint, this bias
might be tackled through the use of international corporate standards
and consistent application of maximum levels of tolerable risk across the
company, regardless of the jurisdiction. Smaller companies operating in
a single jurisdiction are potentially more susceptible to the influence of
cultural norms. Such operations with limited resources and smaller cost
margins may resist risk treatment over and above what they can pur­
chase built into the equipment (i.e. what they can purchase from ven­
dors). To address bias found at this level of the model, regulation of
industrial facilitation may need to draw on international auditing and
certifying bodies.
4.3.4. Biases fundamental to individuals
Biases attributed to influential individuals that led to skewed risk
assessment within workshops were seen to do so through a level of au­
thority or a cognitive heuristic. In the case of the latter, the Availability
Heuristic was found to influence workshop attendants regardless of their
role or company and was described as an inertia in the team. This was
most often described as occurring within groups of workshop partici­
pants and so was presented under Group Influence. Presenting de-
identified evidence of accidents and incidents in similar companies or
sectors, for example by establishing a public register and accessible
database may address such tendencies. While such initiatives are
already available in some sectors, they are not necessarily utilised by
facilitators. Therefore, a code of practice for facilitators to use such
initiatives may be needed. In addition, support for awareness and edu­
cation about the Availability Heuristic as an integral part of facilitator
certification is recommended.
The bias of Authority Figures was found to be an endemic problem of
the workshop methodology and ubiquitous across participants. This was
most often described as stemming from an individual and so was pre­
sented under Individual Influence. To tackle this bias, risk assessment
workshops may benefit from coordinated facilitator training, certifica­
tion and the independent observation of risk assessments by accredited
peers. Adherence to a risk assessment code of ethics by the company
seeking the assessment is also a consideration and would encourage
shared responsibility for the accuracy of risk estimates, as opposed to
outsourcing it to private consultants.
5. General discussion
This study identified dangerous biases with the potential to falsely
understate risk estimates within a workshop setting (RQ1); five biases
were observed at a group level and one at an individual level. These
biases were allocated across Rasmussen’s (1997) socio-technical model
of risk management based on their source (RQ2). Bias origins ranged
from cultural or societal forces, industry norms, company pressures, as
well as pressures associated with occupational roles, and in some cases,
highly dominant individual views. By plotting the biases in terms of
their origin, system levels within a risk management model emerged
from which to better manage them (RQ3).
Biases are an intrinsic part of being human, and workshop method­
ology is designed to stimulate and accommodate debate based on peo­
ple’s differing experiences, knowledge and skill-sets. Risk workshops
reflect collective human knowledge at a specific point in time, and while
not highly accurate, they are currently thought to be a sufficiently
precise instrument for judging risk. As assessment workshops can only
be as effective as their terms of reference and the various human factors
at work within them at the time that they are conducted, this study il­
lustrates that they can be readily influenced by significant forces origi­
nating from different groups and organisations. This implies that
treatment of workshop methodology will be more effective if measures
are sourced from a wide range of system levels.
The hierarchy of controls embedded into WHS regulations and code
of practice for risk management, de-values the efficacy of the lower two
controls (administrative and personal protective equipment) on the basis
12
Safety Science 157 (2023) 105918
that they involve human behavior. Engineering controls sit above these as
human behavior is viewed to play a minimal role in their design and
implementation. However, engineering controls are identified in risk
assessment workshops and the results of this study show that the per­
formance requirements for engineering controls can be just as subject to
individual human behavior as a written procedure. Based on this, it may
be imprudent to assume that engineering controls are any more reliable
than administrative procedures. Indeed, the design and implementation
of engineering controls is fraught with administration, not only in the
determination of performance requirements, but in the documentation,
testing, and commissioning of those controls. Perhaps the key difference
between engineering controls and administrative measures is the num­
ber of individuals involved in the design, with an assumption that the
consensus view is less subject to bias than a single opinion. However,
this study shows that the mechanisms of peer pressure and conformity
can transform an individual opinion into a group consensus. Thus, the
assumption that engineering controls are immune to human factors is
worthy of challenge.
5.1. Practical implications
To our knowledge, this is the first study to open a window into
technical facilitation through a research design collecting data from
practitioners working across different industries. This study is also the
first to look beyond the process of facilitation for measures to treat bias
in risk assessments. The study has brought to light limitations of work­
shop methodologies that are not readily treatable within the workshop
or by administrative controls alone. In doing so, this study reveals the
importance of redistributing the responsibility for the veracity of risk
assessment beyond the facilitator alone.
On its surface, this work highlights industry regulation as a potential
pathway for improving facilitation of formal risk assessment, though
this may have other sizeable impacts (e.g., increased costs to owners of
plant and equipment vendors, more rigorous data collection as input to
risk assessment). A multinational company may have formalised risk
assessment management systems in place at a company level, however
the closest thing to industry regulation are global standards that
recognise the importance of facilitator competence and independence.
An example of such are the Functional Safety Standards (e.g., IEC AS
61508:2015) which require a minimum independence and competency
in the review of instrumented engineering controls in critical safety
applications. This raises the question why there is no explicit require­
ment for such rigor to be applied to non-instrumented engineering
controls.
The results serve as points of reflection for risk assessment workshop
facilitators within industry forums. The need for workshop sponsors to
collaborate with and support facilitators through planning and ensuring
balanced workshop attendance well in advance is clear. Facilitator ed­
ucation should be addressed in professional bodies and organisations
who represent technical professionals. Regulatory codes of practice
should consider minimum levels of facilitator competency and inde­
pendence for risk assessment as a function of the potential risk severity.
Formal recognition, certification, professional development paths, po­
tential curriculum inclusion and a code of ethics should all be considered
for industrial facilitators.
5.2. Strengths, limitations & future research directions
The participants in this study served a semi-diagnostic function in
relation to risk workshops, talking about problems they had seen but
were lacking in agency to do much about. Some such problems had been
documented previously, particularly in process safety, as a result of the
observations of well-experienced expert facilitators. Such work usually
resulted in a suite of “de-biasing” techniques within the workshop itself
and a reiteration of the importance of the role of expert facilitators. This
study sought to put risk workshops in greater context and drew attention
D. Hunt and A. Naweed
to the external pressures that can impact these exercises.
Risk assessments occur in many different settings with and without
the use of data, and with and without large formal workshops. The re­
sults of this study are likely generalisable to formal workshop scenarios
such as HAZOP, Design Review and LOPA but less so in relation to the
informal risk assessments that occur in smaller organisations such as Job
Hazard Analysis, Toolbox Talks, and Task Hazard Analysis. This was due
to the majority of data coming from facilitators who worked with larger
organisations. A broader sampling strategy to include professionals from
smaller companies and more front-line workers who attend risk exer­
cises, both formal and informal, would provide additional insights about
bias.
A key strength of this study was the large number of expert facili­
tators who contributed. Most practitioners in industrial safety are
passionate about their profession and so the participants who responded
to the advertisement were likely that sub-population of engineers who
feel so strongly about safety that they would agree to participate in the
research. To obtain such a diverse and knowledgeable cohort was
unexpected—indeed, its tantamount to a professional conflict of interest
to highlight instances where facilitation could not control for workshop
bias. There are likely practitioners who have few stories of bias and who
believe strongly in the veracity of the existing workshop methodology,
whose views were not offered up.
In terms of future directions for research, the study excluded in­
fluences which arose from a loss of contribution to risk assessments (i.e.,
when individuals withdraw their active involvement). Any resulting
skew from this behaviour is entirely dependent on the remaining active
workshop attendees, and so could not be judged as contributing to Type I
or II errors. As such, these were excluded from this study. It is fair to say
then that bias is not the only factor that can influence risk assessment
and future work may consider the impacts of contribution loss.
In situ observations of risk assessment workshops across a range of
companies and industry sectors would likely provide further insight into
workshop biases and other substantive factors. A survey of effective
management practices (e.g., in relation to risk workshops, the code of
practice, regulatory requirements and corporate standards) may also
inform how different levels of the socio-technical system operate in
relation to risk assessment. Documenting facilitators views on solutions
to bias may inform additional research. It may not be obvious as to how
facilitators detect some biases, patterns of language, body language,
intonation and other communication markers and identifying these
patterns could also inform facilitator education and training.
6. Conclusions
The obvious conclusion from this work, that people may be working
with more risk than they are aware of, is hardly a revelation. The extent
of the fallibility of industrial risk assessments and the lack of agency
reported by facilitators, however, is deeply concerning. Risk manage­
ment is a cornerstone of industrial legislation and the results that come
out of risk assessment workshops provide the performance and reli­
ability requirements for safety–critical engineering controls across all
industries. How do the veracity of these exercises evade examination?
One does not have to look much farther than the position of adminis­
trative controls on the Hierarchy of Controls as evidence of the
perception of human performance and reliability in industrial safety. So,
whilst standards require the audit and re-verification of engineering
controls, surely regulators should require even greater levels of audit
and re-verification of administrative controls. It is astonishing that the
decision-making exercise that sets the performance requirements for
safety–critical controls are in practice, rarely subject to the same scru­
tiny in terms of effectiveness and independence as the controls they
yield. Unfortunately, in most industries, the effectiveness of workshops
is considered the remit of psychologists—a profession often considered
(at least by engineers) to have little to contribute to industrial hazards
outside specialist human factors and ergonomic information. It is hoped
13
Safety Science 157 (2023) 105918
that readers of this study will see the benefit in the diverse review of
their work and activities, particularly given the importance of working
with risk. Like all professions, engineers can have major blind spots
when it comes to disciplines outside their own and it is incumbent on all
professionals working with the safety of the public and workers to be
open to input from all manner of specialists. Key recommendations for
the regulation of risk assessment methods, in particular workshops, are
for greater collection and sharing of failure data, certification and
training of industrial facilitators, and greater consideration of human
factors in engineering design processes, including their contribution to
uncertainties. These considerations are important for members of stan­
dards committees, technical working groups within industries, risk an­
alysts, industrial/organisational psychologists and engineering
professionals alike.
CRediT authorship contribution statement
Deborah Hunt: Conceptualization, Methodology, Formal analysis,
Data Curation, Investigation, Writing - original draft, Writing - review &
editing, Project administration, Resources. Anjum Naweed: Conceptu­
alization, Methodology, Investigation, Supervision, Writing - original
draft, Writing - review & editing, Visualization.
Declaration of Competing Interest
The authors declare that they have no known competing financial
interests or personal relationships that could have appeared to influence
the work reported in this paper.
Acknowledgements
The authors are very grateful to the research participants who took
part in this study.
Funding
The author(s) received no financial support for the research and
authorship of the study or the article
References
Apostolakis, G.E., 1990. The concept of probability in safety assessments of technological
systems. Science 250, 1359–1364.
Asilian-Mahabadi, H., Khosravi, Y., Hassanzadeh-Rangi, N., Hajizadeh, E., Behzadan, A.
H., 2018. A qualitative investigation of factors influencing unsafe work behaviors on
construction projects. Work 61 (2), 281–293.
Aven, T., 2016. Risk assessment and risk management: Review of recent advances on
their foundation. Eur. J. Oper. Res. 253 (1), 1–13.
Aven, T., 2020. Three influential risk foundation papers from the 80s and 90s: Are they
still state-of-the-art? Reliab. Eng. Syst. Saf. 193, 1–8.
Baybutt, P., 2018. The validity of engineering judgment and expert opinion in hazard
and risk analysis: The influence of cognitive biases. Process Saf. Prog. 37 (2),
205–210.
Bengtsson, M., 2016. How to plan and perform a qualitative study using content analysis.
NursingPlus Open 2, 8–14.
Center for Chemical Process Safety. (2011a). Guidelines for hazard evaluation procedures:
Wiley.
Center for Chemical Process Safety. (2011b). Layer of protection analysis: simplified process
risk assessment: Wiley.
Center for Chemical Process Safety (2022) Glossary. Retrieved June 15, 2022, from: https
://www.aiche.org/ccps/resources/glossary?title=risk#views-exposed-form-gloss
ary-page.
Council of Europe, 2022. European and Mediterranean Major Hazards Agreement:
Concept of Risk. Retrieved June 15, 2022, from: https://www.coe.int/en/web/europ
arisks/concept-of-risk.
Colman, A.M., 2001. A Dictionary of Psychology. Oxford, UK: Oxford University Press.
Elo, S., Kääriäinen, M., Kanste, O., Pölkki, T., Utriainen, K., & Kyngäs, H. (2014).
Qualitative content analysis: A focus on trustworthiness. SAGE open, 4(1),
2158244014522633.
Emmons, D. L., Mazzuchi, T. A., Sarkani, S., & Larsen, C. E. (2018). Mitigating cognitive
biases in risk identification: Practitioner checklist for the aerospace sector.
Goh, Y.M., Brown, H., Spickett, J., 2010. Applying systems thinking concepts in the
analysis of major incidents and safety culture. Saf. Sci. 48 (3), 302–309.
D. Hunt and A. Naweed
Government of South Australia. (2011). Work Health and Safety Act 2012. Safe Work
Australia.
Graneheim, U.H., Lundman, B., 2004. Qualitative content analysis in nursing research:
concepts, procedures and measures to achieve trustworthiness. Nurse Educ. Today
24 (2), 105–112.
Guest, G., Bunce, A., Johnson, L., 2006. How many interviews are enough? An
experiment with data saturation and variability. Field methods 18 (1), 59–82.
Food and Drug Administration (2006). Guidance for Industry Q9 Quality Risk
Management. Retrieved June 15, 2022, from https://www.fda.gov/media/71543
/download.
Health and Safety Executive. (2021). Leadership and worker involvement toolkit.
Retrieved, April 7th, 2021, from https://www.hse.gov.uk/construction/.
HM Government (2011). The Management of Health and Safety at Work Regulations
1999. Retrieved June 15, 2022, from: https://www.legislation.gov.uk/uksi
/1999/3242/regulation/3/made.
Hopkins, A., 2005. Safety, culture and risk: The organisational causes of disasters. CCH
Australia.
Hunziker, S., 2019. Countering Biases in Risk Analysis Enterprise Risk Management.
Springer, pp. 17–48.
IEC AS 61508: 2015. Functional safety of electrical/electronic/programmable electronic
safety-related systems..
International Atomic Energy Agency (2018) IAEA Safety Glossary: Terminology Used in
Nuclear Safety and Radiation Protection. Retrieved June 15, 2022, from https://
www.iaea.org/publications/11098/iaea-safety-glossary-2018-edition.
ISO/IEC (2009). IEC 31010: 2009. Risk management-Risk assessment techniques.
ISO/IEC Guide 51:2014(en) Safety aspects — Guidelines for their inclusion in standards..
Johnson, D.M., 2010. The potential for vapour cloud explosions – Lessons from the
Buncefield accident. J. Loss Prev. Process Ind. 23 (6), 921–927. https://doi.org/
10.1016/j.jlp.2010.06.011.
Kaplan, S., Garrick, J.B., 1981. On the quantitative definition of risk. Risk Anal. 1 (1),
11–27.
Körner, U., Müller-Thur, K., Lunau, T., Dragano, N., Angerer, P., Buchner, A., 2019.
Perceived stress in human–machine interaction in modern manufacturing
environments—Results of a qualitative interview study. Stress and Health 35 (2),
187–199.
Leveson, N., 2004. A new accident model for engineering safer systems. Saf. Sci. 42 (4),
237–270.
Ludolph, R., Schulz, P.J., 2018. Debiasing health-related judgments and decision making:
a systematic review. Med. Decis. Making 38 (1), 3–13.
Moldavska, A., Welo, T., 2017. The concept of sustainable manufacturing and its
definitions: A content-analysis based literature review. J. Cleaner Prod. 166,
744–755.
Montibeller, G., Von Winterfeldt, D., 2015. Cognitive and motivational biases in decision
and risk analysis. Risk Anal. 35 (7), 1230–1251.
National Fire Protection Association (2022). Glossary of terms. Retrieved June 15, 2022,
from: https://www.nfpa.org/Codes-and-Standards/Resources/Glossary-of-Terms.
Naweed, A., Balakrishnan, G., Dorrian, J., 2018. Going solo: Hierarchical task analysis of
the second driver in “two-up”(multi-person) freight rail operations. Applied
Ergonomics 70, 202–231.
14
Safety Science 157 (2023) 105918
Naweed, A., Bowditch, L., Chapman, J., Dorrian, J., Balfe, N., 2022. On good form?
Analysis of rail Signal Passed at Danger pro formas and the extent to which they
capture systems influences following incidents. Saf. Sci. 151, 105726.
Naweed, A., Chapman, J., Trigg, J., 2018. “Tell them what they want to hear and get
back to work”: Insights into the utility of current occupational health assessments
from the perspectives of train drivers. Transport. Res. Part A Policy Pract. 118,
234–244.
Naweed, A., Kourousis, K.I., 2020. Winging It: Key Issues and Perceptions around
Regulation and Practice of Aircraft Maintenance in Australian General Aviation.
Aerospace 7 (6), 84.
Paté-Cornell, M.E., 1996. Uncertainties in risk analysis: Six levels of treatment. Reliab.
Eng. Syst. Saf. 54, 95–111.
Naweed, A., Murphy, P., 2022. One-track mind: Investigating positive and negative
applications of non-technical skills in rail network control. Applied Ergonomics 106
(103840). https://doi.org/10.1016/j.apergo.2022.103840.
Pachur, T., Hertwig, R., Steinmann, F., 2012. How do people judge risks: availability
heuristic, affect heuristic, or both? J. Experim. Psychol. Appl. 18 (3), 314.
Peace, C., 2017. The reasonably practicable test and work health and safety-related risk
assessments. New Zealand Journal of Employment Relations 42 (2), 61.
Professionals Australia. (2017). Women in Engineering: realising productivity and
innovation through diversity.
Rasmussen, J., 1997. Risk management in a dynamic society: a modelling problem. Saf.
Sci. 27 (2), 183–213.
Reason, J., 1990. Human error. Cambridge University Press.
Safe Work Australia. (2011). How to manage work health and safety risks: Code of practice:
Safe Work Australia.
Safe Work Australia (2019). Model Work Health and Safety Act. Retrieved June 15,
2022, from: https://www.safeworkaustralia.gov.au/doc/model-work-health-and-sa
fety-act.
Serrat, O., 2017. Knowledge solutions: Tools, methods, and approaches to drive
organizational performance. Springer.
Smith, D.J., 2017. Reliability, maintainability and risk: practical methods for engineers.
Butterworth-Heinemann.
Tabachnick, B.G., Fidell, L.S., 1989. Using multivariate statistics. HarperCollins.
Taylor, T.S., Raynard, A.L., Lingard, L., 2019. Perseverance, faith and stoicism: a
qualitative study of medical student perspectives on managing fatigue. Med. Educ.
53 (12), 1221–1229.
The National Institute for Occupational Safety and Health. (2021). Hierachy of controls.
Retrieved, April 7th, 2021, from https://www.cdc.gov/niosh/topics/hierarchy/def
ault.html.
Tversky, A., Kahneman, D., 1974. Heuristics and biases: Judgement under uncertainty.
Science 185 (4157), 1124–1130.
Vaughan, D., 1996. The Challenger launch decision: Risky technology, culture, and
deviance at NASA. University of Chicago press.
Vaughen, B.K., Kletz, T.A., 2012. Continuing our process safety management journey.
Process Saf. Prog. 31 (4), 337–342.
Wickens, C.D., Hollands, J.G., Banbury, S., Parasuraman, R., 2015. Engineering
psychology and human performance. Psychology Press.