Inadequate risk assessment

There are three types of risk assessments, namely:

1. Baseline risk assessments.
2. Issue based risk assessments.
3. Continuous risk assessment.

Organisations have to assess where they are in terms of risk, identifying the major risks and thereby establishing their priorities and a system for future risk control.  This baseline risk assessment needs to be comprehensive and may well lead to further, separate, more in‑depth risk assessment studies.  The baseline risk assessment must be periodically reviewed, say every one to two years, to ensure that it is still relevant and accurate.

As circumstances and needs arise, separate risk assessment studies need to be conducted.  These are normally associated with a system for the management of change.

This is the most important and powerful form of risk assessment which must take place continually, as an integral part of day to day management.  It will mainly be conducted by front‑line supervisors and it is essential that formal training is provided to enable this process to be efficient.

In closing, please note that there is seldom, if ever, a single cause to an incident.  Incidents take place because a combination of causes come together under exactly the right (or wrong) circumstances.

This Principle of Multiple Causes must always be kept in mind if the true causes of incidents are to be identified and corrected.  Using the Incident Causation Model properly ensures that the Inadequate Control factors are identified and corrected.

Only through an approach such as this will long-term improvements result in fewer incidents.