Weighing the Risks

Knowing what's at stake | Taking control

City officials had a problem. They wanted to build a new municipal incinerator, but realized that the project would face opposition from neighbors concerned about foul odors, spills, air pollution, and increased traffic in the area around the plant. How could they resolve these problems at a reasonable cost, reassure the residents that their concerns had been adequately addressed, and ensure ongoing public support for the project?

Questions like this face many organizations making decisions about the risks involved in a new project or activity. Fortunately, help is available. The Canadian Standards Association (CSA) has published Risk Management: Guideline for Decision-Makers (CAN/CSA-Q850-97). The Standards Council of Canada has approved the document as a National Standard of Canada.

The guideline is suitable for all types of risk issues in any size or type of organization, from a children's hockey team that wants to ensure the safety of its players to an oil company considering the social and environmental impact of a major development project.

Knowing what's at stake

Risk is the chance that some unwanted event will cause the loss of something of value. Risk management is the process of determining:

• the risks associated with an activity;
• how serious those risks are;
• how likely they are to occur;
• how acceptable they might be, given the activity's benefits; and
• how they can be avoided, controlled or prepared for.

In some incidents, an organization can suffer the most serious damage from charges that it was negligent or uncaring. An effective risk management strategy can help to prevent this by showing that the organization was aware of the risks inherent in its activities, and did what it could to prevent them.

While there are several other risk management frameworks in existence, CSA's offers a number of unique features.

A key element in the CSA approach is the involvement of stakeholders anyone who might be affected by the activity under consideration throughout the decision-making process. Stakeholders can provide vital information that might otherwise not be available to decision-makers. Considering stakeholders' perceptions of risk which aren't always the same as the decision-makers' ensures that any decisions reflect their needs, issues and concerns.

The CSA guideline also emphasizes documenting all elements of the process, including the reasons for decisions, so that those decisions can be explained and defended later.

The guideline describes a six-step process. At each step, users may decide to end the process, go back to a previous stage, or move on to the next step. The document includes questions to help with the choice.

The first step in the process is initiation. The organization must identify the risk problem and all its associated issues, assemble a risk management team to provide technical expertise and advice, and identify possible stakeholders. Clearly defining the risk problem is often the most difficult but most important step of the process.

Next comes the preliminary analysis. Here, the organization identifies the potential risks and performs an initial "back of the envelope" analysis and evaluation. This helps to determine if immediate action might be necessary, further study is required, or a particular risk is not an issue.

That's followed by risk estimation: a more detailed assessment of how likely the loss is to occur, and the consequences if it does. The size of the risk can sometimes be expressed in financial terms a potential loss of $10,000 per year, for example, although this may not be appropriate where the risks include environmental damage or death. Stakeholders should be consulted to ensure that they accept the methods used in this analysis and the uncertainty that is inherent in such estimates.

The risk evaluation stage is a unique feature of the CSA guideline. Most other risk management frameworks go "by the numbers" and overlook the question of how stakeholders judge risk. In the CSA process, however, the risks are evaluated in terms of the activity's benefits and the needs, issues and concerns of the stakeholders. This evaluation may determine that the risk is acceptable, or that some effort should be made to reduce either the probability of the risk or its consequences.

Taking control

If the decision is to reduce the risk, the process moves on to the risk control stage. Here, potential risk reduction options are identified and evaluated for effectiveness, cost, and their impact on and acceptability to stakeholders.

In the final stage, action, risk control strategies are implemented, the effectiveness of the decision-making process is evaluated, and the results are monitored. Monitoring helps to determine the accuracy of the assumptions and the effectiveness of the control measures, and allows the organization to react to changing circumstances.

The CSA approach is already being applied by Nav Canada (the non-profit corporation that operates Canada's air-navigation system), Transport Canada, several members of the Canadian Chemical Producers' Association, Fisheries and Oceans Canada, and chemical manufacturer Dow Canada. The U.S. Coast Guard, Environmental Protection Agency and Department of Energy, and the governments of Mexico and Russia, are also considering it. Similar documents have been published by standards bodies in Australia and Japan.

Consensus, January-February 1998, Standards Council of Canada

For information about the new risk management guideline contact CSA: telephone (416) 747-4000 or 1-800-463-6727; fax (416) 747-4149; website www.csa.ca.