Let's talk about how to control risk. So you've got an iso 9001 management system
you've got an iso 14001 management system you've got an iso 45001
management system or an iso 27001 management system for quality, safety,
environment, or information security, any of those standards, let's
talk about how we're going to control our risks.
So thanks for joining us here on Best Practice TV as we're talking about how
to control risk, in the previous video we talked about how to rank risk, this one's
all about control and there's two parts to it there's Part A and there's Part B
around controlling risk. The first obviously is to focus on what we're
actually setting out to achieve we want to minimize the consequences and we want
to minimize the frequency or the likelihood so that the stuff that can go
wrong we want to obviously go into preventive action so we want to prevent
how bad the damages from something happening so how much we upset a
customer how bad an injury or an incident is how about an environmental
issue is or a data security breach, so we want to obviously minimize the
consequences and focus on that and we want to minimize how often it could
happen, so the number of people that are exposed to a health and safety risk or
the number of customers that are exposed to a potential stuff up in our process.
Now we can look at the two parts of that obviously the control so we want to look
at the deciding on the type of control and we've got a prioritized matrix for
that and then we're going to think about the plan, so the first thing is to look
at the hierarchy of control so obviously the first thing we want to do is
eliminate. So is that an option can we eliminate the risk of identified so
we've ranked our risks, we've prioritized them, now we're going through
and saying well that's the thing that could go wrong the consequences are
something we can't accept can we eliminate it. Now of course you can it's
all about decisions, so you don't start a process that's gonna cause, you know
something's going to kill somebody in a OH&S perspective then don't
do it, and so that's eliminating that
particular risk. But if it's something that's absolutely unavoidable, what are
the other controls we can put in place. So we can eliminate, can we substitute, so
can we sub have a substitution and these are just trigger words to get you
thinking about well can we substitute what we're doing can we use safer
chemicals, can we use a different database, can we contact our customers in
a different way, can we do a different environmental initiative, and it's all
about substitution. So we've tried elimination, we've tried substitution, can
we engineer a solution to this problem. So we're looking at engineering
solutions, it could be software, so we've got a new CRM that's going to
keep our customers happy and it's going to avoid issues happening. We
could put guards on our equipment so they're safer, we could talk about
engineering solutions to manage our environmental issues, we could have
software and firewalls and different you know parts to our information security
management system and their engineering solution, so the risk could still be
there the consequences are still there, but we've got an engineering solution. Now we
start to talk about administration, in the last step we we've got a
safety thing we talk about personal protective equipment or we talk about
task management. So that's our last option, so when we're talking about
administration we're talking about policies and procedures we're talking
about signage the sorts of things that people can ignore, so it's difficult to
ignore the risk you know if we've eliminated it it's just not going to
happen but if you put a sign up and it says it's dangerous then it's still you
know this is less effective than this. So it's about effectiveness then obviously
personal protective equipment, you know it's really, really, noisy so we're going
to put on ear muffs. We want to try and take the noise away by eliminating, it not
just rely on the earmuffs. We want to try and take the issue away instead of
relying on someone to do a particular task that they could forget, so we're
just relying on something to do something and it's part of their habit
and they fall out of their habit and they forget to do it so, it's about
effectiveness. So we talked about effective, so these top ones are more
effective than these ones in robust risk management. So that's part one it's
called the hierarchy of control we've taken it from the OH&S and hazard
management industry and we're starting to apply it to quality systems,
environment systems, information security management systems, so that's part one.
Part two now is to say well we've talked about it before in Best Practice TV, who,
what, when, where and how the why because we've got risks, so what's the plan this
is all about the plan, for each of the risks and so we're using the hierarchy
of control to decide on the controls but then we're putting a plan in place
that's got who, what, when, where and how and that's really important to overlay
those two parts to control risk. I hope you like the video, it's really simple.
If you want a practical example for your industry
hit subscribe to our YouTube channel you get lots of free updates and
post a comment below with a question, we'll answer your question, we love doing
it for you here, it's what we're all about here Best Practice Simple
businesses that are fun, efficient and sustainable and we'll see you soon next
time and Best Practice TV, bye for now.