Chapter 5
The risk analysis process: risk treatment

This chapter looks closer into risk treatment, and the following main steps (refer Figure 1.2):

Risk treatment is the process of selection and implementation of measures to modify risk, including measures to avoid, reduce, optimise and transfer risk (refer Section 1.2). How one chooses to treat risk will depend on which type of strategy the organisation has in place for the risk management.

5.1 Comparisons of alternatives

In Section 3.1, we reviewed the most common ways of using the risk analysis in the decision-making process:

We compare alternatives by looking at the risk picture for the various alternatives. If the alternatives are about the same with respect to other concerns, such as costs, the risk analysis gives a good basis for recommending a particular alternative. Normally, we must, however, undertake a weighing between various concerns, and then the cost-effectiveness analysis and the cost-benefit analysis come into play. These analyses make it possible to compare the various concerns, such as risk and costs. These analyses do not, however, provide answers to what is the correct solution and the best alternative. As is the case for all types of analyses, these analyses have their limitations and weaknesses, and they can only provide a basis for making a good decision.

The main problem of the cost-benefit analysis is related to the transformation of non-economic consequences to monetary values. What is the value of future generations? How should we determine a ‘correct’ discount rate? The value of safety and security is not adequately taken into account by the approach. Investments in safety and security are justified by risk and uncertainty reductions, but cost-benefit analyses to a large extent ignore these risks and uncertainties. A cost-benefit analysis calculating the expected net present values does not take into account the risks (uncertainties). To explain this in more detail, consider the following example:

In an industry, two risk-reducing measures I and II are considered. For measure I (II), the computed expected reduced number of fatalities equals 1 (2). The costs are identical for the two measures. Hence the cost-benefit approach would guide the decision-maker to give priority to measure II. But suppose that there are large uncertainties about the phenomena and processes that could lead to fatalities. Say for example that measure II is based on new technology. Would that change the conclusion of the cost-benefit analysis? No, because this analysis restricts attention to the expected value. We conclude that there is a need for seeing beyond the expected value calculations and the cost-benefit analysis when determining the best alternative.

For a specific alternative, the risk analysis will provide a basis for arriving at measures that can modify the risk. Such measures could be either probability reducing or consequence reducing, depending on whether they apply to the right or to the left side of the bow-tie diagram (Figure 1.1). When measures are to be identified, a natural strategy will be to take as the starting point those systems and events that contribute most to the risk.

Reflection

How should we identify the areas and factors that contribute the most to risk?

One way of doing this is by looking at the change in risk if this area or factor had contributed insignificantly to the risk. If the change is large, then this area or this factor is important. See Section 13.9.

In the planning phase of a system or an activity, alternatives and measures will be generated as an integrated part of the organisation's general management processes. The risk analysis work must be an integral part of these processes, and based on the tasks and functions to be fulfilled, the various disciplines must come up with possible alternatives and measures.

ALARP assessments require that appropriate measures be generated. If the aim is to satisfy the risk acceptance criteria or tolerability limits, there may be little incentive for identifying risk-reducing measures if the criteria and limits are relatively easy to meet. Risk acceptance (tolerability) can in such cases be reached without implementing specific measures.

As a rule, some suggestions for measures always arise in a risk analysis context, but often a systematic approach for the generation of these is lacking. In many cases, the measures also lack ambitions. They bring about only small changes in the risk picture. A possible way to approach this problem is to apply the following principles:

  1. 1. On the basis of existing solutions (base case), identify measures that can reduce the risk by, for example, 10%, 50% and 90%.
  2. 2. Specify solutions and measures that can contribute to reaching these levels.

The solutions and measures must then be assessed prior to making a decision on possible implementation.

5.1.1 How to assess measures?

Measures that are identified/suggested are analysed using the principles defined in Section 3.1 and further discussed in this chapter. The measures will, in some cases, have exclusively positive effects (e.g. improved safety), but in many instances the measures could produce both positive and negative effects. An example of this is a measure relating to the use of chemicals, which reduces the risk to personnel but which leads to increased risk for negative impact on the external environment. Another example is the installation of new safety systems that seem to be positive in an accident situation, but this installation increases the system complexity and increases the need for maintenance. The method by which the measures are analysed, however, may remain the same, whether the measures have only positive effects or both positive and negative effects.

As pointed out in Section 3.1, it will often be appropriate to undertake crude analyses of the measures as a screening process to identify measures that clearly should be implemented and those that require more detailed analyses.

Conclusions are often self-evident when computing indices such as the expected cost per expected life saved or expected cost per expected reduced ton of oil over the life cycle of a project. For example, a strategy may be that measures will be implemented if the expected cost per expected life saved is c05-math-000110 million.

A measure that has positive expected present value should be implemented immediately. Crude computations of the expected present value, where one leaves out difficult assessments related to the value of loss of life and damage to the environment, will often be sufficient for concluding to what extent this criterion can justify the implementation of a measure.

A potential strategy for the assessment of a measure, if the analysis based on expected present value or expected cost per expected number of lives saved has not produced any clear recommendation, can be that the measure be implemented if for several of the following questions the answer is in the affirmative:

  • Is there a relatively high personnel risk or environmental risk?
  • Is there considerable uncertainty (related to phenomena, consequences and conditions) and will the measure reduce the uncertainties?
  • Will the measure significantly increase manageability? High competence among the personnel can give increased assurance that satisfactory outcomes will be reached, for example, fewer leakages.
  • Is the measure contributing towards obtaining a more robust solution?
  • Is the measure based on Best Available Technology (BAT)?
  • Are there unsolved problem areas that are personnel safety-related and/or work environment-related? Are there possible areas where there is conflict between these two aspects?
  • Are there strategic considerations?

Reflection

In the assessment of various measures, one often forgets that a measure in many instances also has negative effects, with respect to not only costs but also safety of personnel.

On the gas transport pipeline from Platform A to onshore, there is an underwater valve that should shut off in the event of leakage in the risers or in the topside riser valve. This valve is defined as safety critical, and in accordance with normal practice and regulatory requirements, it must be tested annually.

The testing of the valve is a risk-reducing measure to ensure that the valve functions in the event of an accident. If the valve does not function in the event of large-scale leakages/fires, then this can obstruct personnel from escaping over a bridge to Platform B. They can become trapped on Platform A. In addition, failure of the valve will result in considerable material losses.

At the same time, one realises that the testing of such a valve is a demanding undertaking and leads to a risk for those persons that carry out this work. Experience shows that a large part of the leakages occur during the closing down and the run-up of the facility. In consideration of the safety of the maintenance personnel, the maintenance should not take place more often than is absolutely necessary.

The maintenance activities are also of utmost importance economically, as several platforms must shut down while the testing takes place. There is also a danger that a valve might not open following testing. In the case of an underwater valve such as this, the result could be a production shutdown at several platforms over c05-math-0002 weeks, causing huge economic losses.

How often should we test these valves? All relevant factors should be considered prior to making a decision. In this case, we seek to find a solution whereby maintenance is carried out as seldom as possible, but often enough to ensure that the valve will function with a sufficiently high probability if an accident should occur. However, a simple formula that provides a solution to the problem does not exist.

5.2 Management review and judgement

When various solutions and measures are to be compared and a decision is to be made, the analysis and assessments that have been conducted provide a basis for such a decision. In many cases, established design principles and standards also provide clear guidance. Compliance with such principles and standards will be among the first reference points when assessing risks.

It is common thinking that risk management processes, and especially ALARP processes, require formal guidelines or criteria (e.g. risk acceptance criteria and cost-effectiveness indices) to simplify the decision-making. Care has however to be shown when using this type of formal decision-making criteria, as they easily result in a mechanisation of the decision-making process. Such a mechanisation is unfortunate because of the following:

  1. 1. Decision-making criteria based on risk-related numbers (probabilities and expected values) alone do not capture all the aspects of risk, costs and benefits.
  2. 2. No method has a precision that justifies a mechanical decision based on whether the result is over or below a numerical criterion.
  3. 3. It is a managerial responsibility to make decisions under uncertainty, and management should be aware of the relevant risks and uncertainties.

The reader is referred to the discussion in Chapter 13.

Example of management review and judgement

An oil company has two undersea pipelines supplying an important customer with natural gas. The gas is produced at two different processing facilities and fed into the two pipelines. En route, the pressure drops to a level where it is considerably lower at the delivery end. The delivery takes place at two different sites located at a considerable distance from each other. The company is of the opinion that if it installs a plant for gas pressure boosting (a pumping station) between the processing facility and the delivery site, it will be able to deliver more gas through the pipeline. The company is evaluating various alternative solutions for pressure boosting:

  1. 1. Two separate installations – one for each pipeline.
  2. 2. A single installation for compressing the gas. This solution means that the single pipeline must be re-routed over several kilometres.

Alternative 2 is significantly less expensive than alternative 1.

The various alternatives are assessed and compared in a risk analysis. The conclusion of the analysis is that the risks for both personnel and the environment are low for the single installation solution.

The management then undertakes a management review and judgement. Today there are no ‘probable’ events that could simultaneously stop delivery in both pipelines as the processing facilities, pipelines and delivery sites are separate. The company does not wish to increase its vulnerability by setting up a common point for these two independent systems. In the case of an event at the installation proposed in alternative 2, this could have an impact on the entire gas supply to the customer. For this reason, alternative 2 is rejected and alternative 1 is implemented.

Reflection

To verify, ALARP, procedures based on engineering judgements and codes are used, but also traditional cost-benefit analyses and cost-effectiveness indices. When using such analyses, guidance values are often used, to specify values that define ‘gross disproportion’. A typical number for a value of statistical life used in cost-benefit analysis is c05-math-00031–2 million (HSE 2003, Aven and Vinnem 2005). For certain areas the numbers are much higher, for example, in the offshore UK industry it is common to use c05-math-00046 million (HSE 2006). This increased number is said to account for the potential for multiple fatalities and uncertainty and may be viewed as an extra weight justified by the ALARP principle and the principle of ‘reversed burden of proof’. What is your response to this practice?

This practice is indeed questionable, as the expected net present value calculations performed in a cost-benefit analysis do not adequately reflect the risk and uncertainties as discussed in Section 5.1. It can be discussed whether the ALARP principle with its gross disproportion criterion should imply a higher value of a statistical life than normal, but the argument would not be the risk and the uncertainties. Moreover, one may also question why more resources should be used on safety measures for one group than for another. Does this mean that society has a stronger preference for avoiding fatalities in one specific group of people?