From hazard to risk: definitions, perception and risk criteria

HSE-103 introduced hazard recognition, the basic likelihood and severity matrix, job hazard analysis and the idea of reducing risk as low as reasonably practicable. This course goes further. It is about the formal methods that safety professionals, engineers and joint committees use when a simple checklist is not enough: structured task analysis, calibrated risk matrices, what-if reviews, hazard and operability studies (HAZOP), failure modes and effects analysis (FMEA), bowtie diagrams, fault trees and event trees, layer of protection analysis (LOPA) and quantitative risk assessment. Before any of those methods makes sense, the words they use must be clear, because most arguments in risk workshops are really arguments about definitions.

This first lesson sets out the vocabulary, explains why people judge risks differently from the numbers, and introduces risk criteria: the yardsticks an organization uses to decide whether a risk is acceptable, tolerable with further work, or intolerable. The course is an awareness and practitioner introduction. It prepares you to take part in formal studies and to read their results critically. It does not qualify you to facilitate a HAZOP, certify a safety instrumented system or sign off a quantitative risk assessment.

Hazard, risk and the words in between

A hazard is a source of potential harm: stored energy, a toxic chemical, a moving machine part, a height, a hostile person. ISO 31000:2018 defines risk more broadly as the effect of uncertainty on objectives, which covers financial and reputational risk as well as safety. For occupational and process safety, the working definition is narrower: risk is a combination of how likely a harmful event is and how bad its consequences would be. Most methods in this course estimate one or both of those two things.

Several other terms appear in every study. An initiating event, sometimes called a cause, is what starts a sequence: a valve left open, a seal failure, a forklift strike. A hazardous event, or top event, is the point at which control of the hazard is lost, such as a loss of containment. A consequence is the outcome: injury, fire, environmental release or lost production. Controls, safeguards and barriers are all words for the measures that prevent the event or reduce its consequences. Residual risk is what remains once those controls are in place and working.

Likelihood, frequency and probability

Likelihood is a general word for how probable something is. In quantitative work it is split into two different ideas that must not be mixed. Frequency is how often an event happens per unit time, for example 0.1 per year, meaning once every ten years on average. Probability is a dimensionless number between 0 and 1, for example the probability that a relief valve fails to open when demanded is 0.01. Fault trees and LOPA combine both: an initiating frequency multiplied by one or more probabilities of failure on demand gives the frequency of the final outcome. Multiplying two frequencies together, a common mistake, gives a meaningless unit of per year squared.

Severity, or consequence, is described in categories such as minor injury, lost-time injury, permanent disability and fatality, or as numbers such as the expected number of people harmed, the litres released, or the dollar cost. Many organizations use several consequence types side by side, for example people, environment, assets and reputation, and rate each scenario on the worst of them.

Risk perception: why numbers are not the whole story

People do not judge risks only by their expected harm. Research by Paul Slovic and others since the 1970s shows that risks feel larger when they are involuntary, unfamiliar, catastrophic, invisible, unfairly distributed or controlled by someone else, and smaller when they are voluntary, familiar and under our own control. That is why a community may oppose a chemical plant whose calculated risk is lower than the risk of driving to work, and why experienced workers may underrate a task they have done safely a thousand times.

Perception matters in formal risk assessment in two ways. First, it shapes the criteria an organization and society are willing to accept: most criteria are stricter for the public than for workers, and stricter for events that could kill many people at once. Second, it biases the people in the workshop. Familiar hazards get rated too low, vivid recent incidents get rated too high, and the person with the loudest voice often sets the score. Lesson 12 returns to these biases and how a good facilitator manages them.

Risk criteria and the ALARP framework

Risk criteria are decided in advance so that the result of an assessment can be judged consistently. Without them, every study ends with the question "Is that good enough?" and the answer depends on who is in the room. ISO 31000 asks organizations to set criteria as part of establishing the context, and ISO 45001 clause 6.1 requires an organization to determine and assess OHS risks and opportunities using methods it defines.

The most widely used structure for safety criteria is the ALARP framework developed by the UK Health and Safety Executive in its 2001 document Reducing Risks, Protecting People. Risks are sorted into three regions. In the intolerable region, the risk cannot be justified except in extraordinary circumstances and must be reduced. In the broadly acceptable region, the risk is so low that further effort is rarely needed, though it must be maintained. In between is the tolerable or ALARP region, where risk is accepted only if further reduction would be grossly disproportionate in cost, time or effort to the benefit gained.

The UK boundaries are expressed as individual risk of death per year. The top boundary is about 1 in 1,000 per year for workers and 1 in 10,000 for members of the public; the bottom boundary is about 1 in a million per year for both. Other jurisdictions and companies choose different numbers, and many use frequency targets per scenario rather than individual risk. Lesson 11 covers these quantitative criteria, including the Canadian land use guidelines that grew out of the work of the Major Industrial Accidents Council of Canada (MIACC).

Canadian OHS law does not use the term ALARP, but the general duty in every jurisdiction to take every precaution reasonable in the circumstances, together with the due diligence defence recognized by the courts, works in a similar way. An employer that has identified a hazard and stopped reducing the risk while further reasonable precautions were available is exposed. CSA Z1002 and CSA Z1000 give the management-system expectations.

The risk assessment process

Whatever method is used, the overall process is the same. ISO 31000 describes it as establishing the scope, context and criteria; risk identification; risk analysis; risk evaluation; and risk treatment, surrounded by communication, consultation, monitoring and review. Identification finds what could go wrong. Analysis estimates likelihood and consequence, qualitatively or numerically. Evaluation compares the result with the criteria. Treatment selects and implements controls, using the hierarchy of controls from HSE-103, and the cycle repeats with the residual risk.

The formal methods in this course fit into that process at different points. HAZOP and what-if are mainly identification methods. Risk matrices, LOPA and quantitative risk assessment are analysis and evaluation methods. Bowties and fault trees do both, and also communicate how controls work. Choosing the right method for the question, the stage of the project and the level of risk is the subject of Lesson 2.