The CCM Journey Model and Mapping Tool

The following tool is intended to assist a company, business unit or site with identification of their current context related to CCM. The tool
suggests that certain important precursors should be in place before embarking on a major CCM program (Step 4 in the tool). Note that there may
also be differences that are important to recognise between sites.

Work Process
CC Management
Critical Control CCM
Planning
Control Focus Focus
Limited
Control Focus
 Characteristics Limited Control Focus Control Focus Critical Control Focus CCM Planning Work Process CCM

Leadership mindsets Compliance Compliance but support Seeing value and CCM is driven by line CCM is an accepted,
health and safety appreciating the focus leaders important part of the work
recommendations process

Individual mindsets Limited appreciation for the Limited appreciation for the Engaged in the process and Critical controls are an Work methods and CCM are
control focus critical control focus some critical control accepted focus the same
understanding

Finding the highest Basic historical or proactive Systematic historical or proactive Effective historical Proactive and lessons Proactive and lessons learned
risk unwanted methods for priority methods for priority unwanted or proactive methods for MUEs learned processes are processes identify MUEs
events unwanted events events combined to identify MUEs

Analyzing controls Controls noted to re-rank BTA applied to discuss controls Critical controls identified Critical controls are Identified critical controls
and identifying the risk but no significant control and their effectiveness using BTA and effectiveness identified with objectives include information for work
most critical discussion and performance process integration
requirements

Defining required No discussion of required No performance requirements Control information defined, Critical control performance Integrated critical control
control performance control performance defined including accountability requirements defined and information is in work
the verification process process requirements

Embedding and Limited, if any, embedding and Some informal or sporadic Some monitoring is defined All critical controls are Verifying the work process
managing controls monitoring of controls monitoring of controls and done for critical controls systematically embedded includes critical controls
and verified and status is
reported

Improving controls Sporadic actions related to Improved action management Deviations from critical Any deviations from the CCM Acting on deviations in work
controls, close out limited but not well linked to control monitoring generate planning expectations are process includes critical
controls actions investigated and actioned control needs

Read across from left to right for each item in column 1. Identify the text that most closely represents the current status of your company, business
unit or relevant site. Consider the average site if considering a group of sites. For leaders and individuals, also consider the average rather than the
most positive or negative. Record the relevant Journey Step for each topic area on the Scoresheet that follows the journey information.
 Journey Step 1
Limited Control Focus
General The business, site or asset,
Characteristics has a limited consideration
of controls for reducing
risk. Risk assessments have
some control information
but do not consider
effectiveness when
establishing outcomes like
acceptability of risk. The
focus may be on the Risk
Matrix and satisfying a
subjective discussion that
residual risk is ‘in the green’
(a low risk rank). There is
no effective Risk Register. If
one exists it may list too
many events, limited
control information and
limited accountability for
controls.
Journey Step 2
Control Focus
The business, site or asset,
has adopted the need to
identify and discuss
controls as a way to
determine if the risk is
acceptable. Tools such as
Bowtie Analysis (BTA) are
used, replacing the
insufficient analysis that
Hazards Analysis or WRAC
forms provide. Use of the
BTA includes some
systematic method of
discussing the effectiveness
of controls considering
dimensions such as design
intent (Hierarchy of
Control) and quality of
application / availability.
This is done to optimise the
risk reduction related to
the priority unwanted
event. The information is
usually captured in a Risk
Register.
Journey Step 3
Critical Control (CC)
Focus
The business, site or asset,
has adopted a broad-brush
historical analysis or risk
assessment method to
identify high priority
unwanted events that can
be listed in a Risk Register
along with the most Critical
Controls. The most Critical
Controls are identified by
using BTA and control
effectiveness analysis to
review and improve the
overall control strategy and
derive a short list of the
most critical to be noted in
the Risk Register along with
assigned accountability for
the controls.
Journey Step 4
CC Management
Planning
The business, site or asset,
has defined and applied a
Critical Control
Management Planning
approach similar to the
ICMM guide steps. Risk
Management has become
Risk Assessment and
Control Management with
a much larger focus on
selecting a few Critical
Controls (CC) using criteria
for Material Unwanted
Events (MUEs) and applying
a management approach
that carefully defines a
verification and reporting
process for each CC, as well
as clear accountability for
embedding verification and
reporting. CCM does not
replace other risk
management activities but
creates an effective
systematic approach to
managing material risks.
Journey Step 5
Work Process CC
Management
The business, site or asset,
has evolved the CCM
information into the
production process so that
Critical Control (CC)
information is not seen to
be part of a health, safety
or environment initiative.
Work process information
such as procedures, plans
or guidelines includes the
CC requirements and the
verification process is
integrated into the roles of
the relevant personnel as
part of their defined
management role. The
focus is still on CCs but they
are part of the Critical
Controls for ‘Safe
Production’. The ‘way we
do business’ is Work
Process CCM.
 Journey Step 1 Journey Step 2 Journey Step 3 Journey Step 4 Journey Step 5
Limited Control Focus Control Focus Critical Control (CC) CC Management Work Process CC
Focus Planning Management
PEOPLE
Leadership The average leader has a The average leader overtly The average leader sees The average leader takes The average leader or line
Mindset ‘compliance mindset’, supports the value in the focus on part in the planning or manager recognizes that
willing to act in order to recommendations and controls and particularly scoping of the Critical the integrated Critical
comply with regulations or efforts of the H&S the most Critical Controls Control Management Control (CC)) information is
company/ business function but may not be for high priority unwanted Process so that identified a necessary part of the way
requirements but not engaged in the process of events. The line Critical Controls (CCs) the business or site derives
(consider the
engagement in H&S risk shifting the site personnel management is engaged in related to Material and applies the various
‘average leader’
management. Management toward a focus on controls. the development and Unwanted Events (MUEs) project, work or task plans.
– in other
of H&S is mostly done by It remains with the H&S finalisation of a Risk are managed through a As such CCM is an
words, for the the H&S department. function to promote the Register that includes the process of defining the CC accepted, important part of
company or site need to consider controls most Critical Controls and performance requirements work processes. The
do not consider more carefully and use the setting of accountability and, thereby, a verification verification, reporting and
the most or methods like Bowtie for managing the noted process that effectively discussion of CCs is a
least effective Analysis. controls though actions monitors and reports CC normal part of production
leader but may not be tracked. status to those accountable and maintenance meetings,
rather those for the CCs related to the seen by all line managers as
MUEs. Leaders actively ‘the way we do business’.
that best
promote and support the
illustrate the
CCM initiative, including
norm)
relevant discussions and
reporting in management
team meetings.
 Journey Step 1
Limited Control Focus
Individual The average person on the
site sees risk management
Mindset as a requirement for some
work but does not
appreciate the value or see
the need to focus on its
(consider the quality or discuss controls
‘average person’ required to reduce
potentially unacceptable
– in other
risks. The Risk Matrix may
words, for the
be used at the site as the
company or site tool for determining if the
consider the risk is acceptable. Risk
norm) assessment may require
consideration of risk with
controls but controls are
not significantly reviewed.
The average person sees
risk management as an
exercise in “getting it in the
green”. In other words, if
the risk is recorded as
green based on the matrix
then the task can proceed.
Journey Step 2
Control Focus
The average person is
beginning to see the
importance of
using/ensuring controls are
in place for work but the
thinking and relevant
actions are sporadic. The
use of the Risk Matrix to
‘re-rank’ (rank before and
after controls are
discussed) for judging risks
acceptability has been
stopped. Some personnel
have been involved in
Bowtie Analysis (BTA)
exercises, discussing
controls and effectiveness
but the BTA team exercises
are still seen as workshops
that doesn’t really link to
thinking and practices at
the workface.
Journey Step 3
Critical Control (CC)
Focus
The average person on the
site is engaged in the
process of identifying and
managing controls for the
risk. The site has identified
the highest risk unwanted
events and reviewed
controls related to those
events using methods such
as BTA. The site risk register
includes the highest risk
unwanted events and the
most important controls for
those events with
accountability for those
controls identified. The
materiality of the
unwanted events and the
selection of Critical
Controls may be discussed
but detailed management
planning is not in place.
Journey Step 4
CC Management
Planning
The average person on the
site is actively engaged in
the OH&S (E) CCM
initiative. Critical Control
(CC) information for the
site has been derived from
corporate or business
resources, or carefully
deduced on site. Where
relevant CC information has
been embedded in
processes, plans or task
information as required,
knowledgeable personnel
recognize the need for the
CCs and the importance of
the processes that ensure
the CC is in place and
functioning. The
verification process is also
understood, including the
need to stop and
investigate if verification
results drop below
acceptable CC triggers. As
such, CCs are an accepted
focus.
Journey Step 5
Work Process CC
Management
The average person on the
site is actively engaged in
the development and
application of quality work
processes from project to
task plans which include
information about the
relevant CCs for the
material risks. The CCs are
not seen as OH&SE
requirements but rather
aspects of the project or
task which are critical to
achieving the desired
outcomes. New project and
task plans are derived
considering relevant
hazards and threats so that
the required CC
information is included.
Work methods and CCM
are the same.
 Journey Step 1 Journey Step 2 Journey Step 3 Journey Step 4 Journey Step 5
Limited Control Focus Control Focus Critical Control (CC) CC Management Work Process CC
Focus Planning Management
ACTIVITIES

Finding the The site or business applies The site or business applies The company or business The company or business The company or business
highest risk historical or proactive historical or proactive undertakes systematic undertakes systematic undertakes systematic
methods to find high methods to find high analysis of historical events analysis of historical events analysis to identify a list of
unwanted
priority unwanted events. priority unwanted events. A or applies detailed risk to effectively capture the Material Unwanted Events
events Some relevant controls are list of identified events is assessment methods to ‘lessons learned’ and also (MUEs) considering hazards
noted and discussed to re- used to undertake a second identify a list of Material applies detailed risk and threats that could
rank risk. stage control analysis. Unwanted Events (MUEs) assessment methods to affect all business
identify a list of Material objectives.
Unwanted Events (MUEs)
Analysing No significant discussion of Relevant controls are often BTA and control BTA and control BTA and control
controls & controls other than basic discussed using Bowtie effectiveness analysis effectiveness analysis effectiveness analysis
information related to re- Analysis (BTA). methods are used to methods are used to methods are used to
identifying the
ranking risk. examine each MUE, examine each MUE, examine each business
most critical identify opportunities to improve controls and to related MUE, improve
improve controls and to select the Critical Controls controls and to select
select important controls (see definition) CCs for integration into the
for listing with the MUEs in work process.
the site Risk Register.
Defining No discussion or limited Risk Registers include The important controls are CCs are identified with Same process as suggested
required application of control defined controls to included in the Risk objectives and performance in Step 4 plus the processes
information reduce risk but no Register with defined requirements. inspection of inspection, monitoring,
control
monitoring, verification or accountability, possibly for and monitoring, as well a verification and reporting
performance performance monitoring the control, but defined verification process are not part of an OH&S
requirements discussed no performance criteria. that samples the CC initiative but rather the
monitoring for status management of the work
reporting to the CC Owner process in general.
and MUE Owner
 Journey Step 1
Limited Control Focus
Embedding & Limited, if any, embedding
managing of control information and
formal monitoring
controls
of controls
Improving Sporadic actions related to
controls controls usually based on
incident investigation with
limited close out.
.
Journey Step 2 Journey Step 3 Journey Step 4 Journey Step 5
Control Focus Critical Control (CC) CC Management Work Process CC
Focus Planning Management
Some informal or sporadic Some monitoring is CC information is Same process as suggested
monitoring of controls defined and done for embedded into site in step 4 plus, the
Critical Controls management and all CCs verification process checks
are systematically the overall work process
verified and status is including CCs.
reported
Improved Action Deviations from the CC Any deviations from the Acting on deviations in
Management but not well monitoring generate CCM expectations are work processes includes
linked to controls. actions. investigated and actioned addressing CC
requirements.
CCM Journey Model – Suggestions for going forward

General Characteristics
Moving from Journey Step 1 to 2

Limited Control Focus to Control Focus

See below for Action Planning specific to each topic to start your control focus and move toward CCM

PEOPLE
Engage leaders – involve them in the introduction of Bowtie Analysis (BTA) as an important method to help the
Leadership Mindsets company/site move on from re-ranking issues and thereby move towards eliminating fatalities. Provide information
to the leaders so they can recognize and communicate success
Promote ‘control thinking’ - Introduce the workforce to the issues with re-ranking, the need to focus on controls to
Individual mindsets
be ‘safe’ and the use of BTA, with their input, as the way forward.
ACTIVITIES/SYSTEMS

Finding the highest risk
unwanted events
Analysing controls &
identifying the most critical
Defining required control
performance
Embedding & managing
controls
Review the methods for identifying the highest risk unwanted events - Ensure they are systematic, considering both
hazards and steps of the mining/minerals process.
Start applying Bowtie Analysis – define the objective of its use, select potential facilitators, train if internal and start
application on topics or events perceived to be highest priority, communicate results well to demonstrate success.
Identify control improvements based on outputs from the BTA exercises
No formal process to embed or manage controls

Improving Controls Take action to improve the controls as identified and close out the actions. Communicate success!
CCM Journey Model – Suggestions for going forward

Moving from Journey Step 2 to 3

Control Focus to Critical Control Focus
General Characteristics See below for Action Planning specific to each topic to move to a Critical Control Focus

PEOPLE
Involve leaders – involve them in the development and use of effective site/asset Risk Registers that focus on the
highest risk unwanted events and important control information including accountability. Suggest that leaders’ KPIs
Leadership Mindsets
be defined within the organization related to developing the Risk Register and making required improvements in
controls in a defined time frame.
Require ‘control thinking’ - Introduce the workforce to the Risk Register as the most important tool for defining the
Individual mindsets focus on high consequence, low likelihood events. Embed the control identification and monitoring need in workforce
thinking through training, monitoring and reinforcement.
ACTIVITIES/SYSTEMS
Finding the highest risk Review the methods for identifying the highest risk unwanted events - Ensure they are systematically providing a
unwanted events clear description of all the high priority unwanted events for the Bowtie Analyses (BTA).
Monitor the quality of the BTAs – Ensure the BTA exercises are being undertaken with a quality process so that their
Analysing controls &
outputs are useful lists of important controls, ways to increase their effectiveness if necessary and ideas for additional
identifying the most critical
control where necessary. Look for consideration of the Hierarchy of Control.
Develop and apply basic control management information - Include important controls that are identified in the BTA
Defining required control
in the Risk Register with monitoring requirements and accountability for undertaking the monitoring and ensuring the
performance
control is in place and effective.
Embedding & managing Communicate the Risk Register information on events and important controls to the workforce who makes the
controls decisions about use of the controls. Also write monitoring responsibilities into relevant job documents.
Take action to improve the controls as identified and close out the actions, as well as take action when monitoring of
Improving Controls
important controls, as defined in the Risk Register, is not to expectations by practice or results. Communicate success!
CCM Journey Model – Suggestions for going forward
Moving from Journey Step 3 to 4
Critical Control Focus to Critical Control Management Planning
Use the process outlined in this ICMM CCM process document - Undertake a Gap Analysis of your company, business and
General Characteristics site/asset control management approach for the highest risks. Identify gaps and define actions to move toward the full CCM
initiative.
PEOPLE
Include Leaders – CCM requires careful design, called Scoping in the ICMM CCM document. Leaders should be actively involved in
Leadership Mindsets the Scoping and the detailed definition of the entire initiative. They should be encouraged to look for opportunities to be involved,
visible and supportive to CCM.
Reinforce ‘control thinking’ – Considering the average individual’s commitment to control management, an introduction to the
Individual mindsets rationale for CCM should be given to the relevant workforce with a clear understanding of the nature of the change and the
implications to their work. Workforce involvement is critical for success.
ACTIVITIES/SYSTEMS
Finding the highest risk Review the methods for identifying the Material Unwanted Events (MUEs) - Ensure they are systematically providing a clear
unwanted events description of all the MUEs for the Bowtie Analyses (BTA).
Analysing controls & Check the quality of the BTAs – Ensure BTA exercises follow a quality process so that their outputs include an accurate control
identifying the most critical image that allows for successful use of the Critical Control Selection Criteria.

Defining required control Introduce the CC performance requirements and management information requirements, monitoring the quality – a format for
performance CCM information must be defined and utilised similar to that outlined in Step 5 and 6 in the ICMM CCM document.

Embed the CC and begin the verification process – Information and understanding about the CC should be located where the
Embedding & managing
decisions are made about use or existence of the controls. Note that CC inspection and monitoring methods may need to change.
controls
Once completed, verification can commence. Also write verification responsibilities into relevant job documents.
Take action to address CCM variances – Act on variations from expected CC performance. Put in place procedures to stop work if
Improving Controls the defined CC unacceptable availability trigger is exceeded. Also, define investigation methods for this situation, including re-
visiting of the CC information. Communicate success!
CCM Journey Model – Suggestions for going forward
General Characteristics Moving from Journey Step 4 to 5
Critical Control Management Planning to Work Process Critical Control Management
Improvement from Step 4 to 5 involves redefining the ICMM CCM process in the document to integrate
CCM into the overall work process. Some possible actions are listed below.
PEOPLE
Support leaders - in Step 5 the CCM process is defined and owned by production/maintenance management
Leadership Mindsets as part of their design and work management responsibilities. Support for their process may be required.
Communicate success as part of moving to being a resilient organization.
Support ‘control thinking’ –the average individual should be making an adjustment from seeing CCM as a
Individual mindsets H&S(E) part of work to seeing CCs for all work quality threats included in the work process requirements. This
change will need to be explained and supported.
ACTIVITIES/SYSTEMS
Finding the highest risk Review the methods for identifying the Material Unwanted Events (MUEs) - Ensure they are systematically
unwanted events considering all threats to the work processes of the businesses.
Check the quality of the BTAs – Ensure BTA exercises can effectively consider threats to the work process
Analysing controls &
other than the previous OH&S (E) areas, such as sources of delay, excessive cost, reduced production, etc.
identifying the most critical
and allow for successful use of the Critical Control Selection Criteria.
Defining required control Check the CC performance requirements and management information requirements – Ensure that the
performance format for CCM information is suitable for CCs that are related to all types of business MUEs.
Review the locations and formats for embedding the CC and integrate the verification processes –
Embedding & managing
Information and understanding about the CCs will now be a part of the defined work processes which could
controls
mean that all work process guidelines, procedures or instructions will need redevelopment.
Take action to address Work Process CCM variances – As before, act on variations from expected CC
Improving Controls performance. Thoroughly investigate significant variances from expectations and continuously improve the
business. Communicate success!