Operational risk management: A bioenvironmental engineering (BEE) perspective

Risk management is the process used by decision-makers to eliminate or reduce risk. The United States Air Force has been applying risk management philosophy and methods experientially for years. However, Operational Risk Management (ORM) is a process that can provide greater and more consistent results via a systematic method rather than solely relying on experience.

Principles of ORM are the basis of risk management decisions. These principles are:

. Accept no unnecessary risk

Make risk decisions at the appropriate level

Accept risk when benefits outweigh costs

Integrate ORM into Air Force Doctrine and planning at all levels

The ORM principles are applied before the anticipated mission is executed and continuously applied as the operation progresses. Unnecessary risk comes without a commensurate payback and should not be accepted. The logical choices are those that accomplish the mission and expose personnel and resources to the lowest possible risk.

One of the functions of Bioenvironmental Engineering is to perform occupational health surveillance of installation workplaces to identify and control health hazards. Anticipation, recognition, evaluation, and control of health hazards are the foundation of occupational health surveilance. ORM, with its six-step process, aligns nicely with the BEE's occupational health surveillance process.

ORM is a continuous process designed to detect, assess, and control risk while enhancing performance and maximizing combat capabilities. The six-step process depicted in AFI 91-213, Operational Risk Management Program, is illustrated in Figure

1. There are specific actions to each step within the ORM process. The time and resources available, importance or visibility of the mission, and level of risk involved, determine the depth of the risk management process.

Identification of hazards requires mission analysis, listing of hazards, listing of causes, and in-depth hazard identification. Bioenvironmental Engineering does this through the anticipation and recognition of health hazards. The mission is broken down into bite-size chunks (tasks). Analysis of the tasks is accomplished by examining how the man, machine, and media (external environmental factors) interact to produce a successful mission or sometimes mishap. Management procedures that impact on these elements are also analyzed. Listing the hazards and potential hazards provides a tracking mechanism and serves as a record for future use. Identification of the root causes allows for the effective application of risk controls. Lastly, more detailed and in-depth hazard identification is utilized for medium and longterm planning, complex operations, or operations in which the hazards are not well understood.

Evaluation of hazard exposure, hazard severity, and mishap probability is required to assess the risk. Occupational health surveillance quantifies the workers' level of exposure and serves as a guide for devising risk control measures. Hazard severity provides a qualitative measure of the worst credible health hazard that could occur. A quantitative or qualitative approach may be used to determine the probability that a hazard will cause a mishap. Figure 2 is an example matrix that is used to combine health hazard severity and probability to form a risk assessment index. This index is used as the basis for judging the acceptability of risk, determining the management level at which the decision of acceptability will be made, and prioritizing resources to resolve the risks.

To analyze risk control measures, you must identify control options, determine their effects, and prioritize these options. The key is to identify as many risk control options as possible to address the root causes identified in Step 1 of the ORM process. This includes determining whether the process creating the risk can be eliminated.

Occupational health surveillance considers engineering controls, administrative procedures, and personal protective equipment (PPE) as the risk control options. Bioenvironmental Engineering may recommend installation of an industrial ventilation system (engineering control) to reduce or eliminate workers' chemical exposure. Engineering controls attack the hazard at the source and are considered the most viable control option.

If engineering controls are not feasible, administrative procedures are considered. For example, the time an employee may work in a hot environment before resting is defined to reduce the probability of heat stress. Lastly, if no other control options are viable, PPE is considered for controlling the hazard.

After the control options are identified, the effect the control options would have on the overall risk must be determined. This aids in prioritizing controls that will reduce the risk to an acceptable level.

When making decisions, those controls that will reduce risk to an acceptable level should be selected. Once the risk control decision is made, assets must be made available to implement specific controls. The implementation directive must be clear and accountability established for the decision-maker as well as the individual responsible for implementation. Finally, to be successful, upper management must be supportive of the control measures.

The last step in the ORM process requires supervision and review to ensure implemented control measures are eliminating or reducing the risks. The operation must be monitored to establish that risk controls are effective and remain in place. Actions may also be necessary to identify ineffective risk controls and reinitiate the risk management steps. This usually requires Bioenvironmental Engineering to perform follow-up surveillance after control options have been implemented.

Leaders should be able to utilize the risk management process to make sound decisions. The risk management process exists at three levels: time-critical, deliberate, and strategic. Time-critical risk management is employed to consider risk while making decisions in a time-- compressed situation. Bioenvironmental Engineering finds this helpful when an unplanned event occurs, such as a chemical spill.

Deliberate risk management is the application of the ORM process when time is not the driving factor, such as routine occupational health surveillance. Other examples of the deliberate application include planning for upcoming events, review of standard procedures, and disaster response training. Strategic risk management is the deliberate process with more thorough hazard identification and risk assessment. It is utilized to study hazards and associated risks in complex operations or when hazards are not well understood. For example, the introduction of a new aircraft to a base may present risks that the Bioenvironmental Engineering staff is not familiar with. The new aircraft may be made of composite materials whereas the previous aircraft was metal. These two distinguishing characteristics may present significantly different health risks to workers during aircraft maintenance.

Most of us probably evaluate risk more often than we realize while performing our Air Force duties. A hospital treating a heart attack patient before a patient with a common cold, a pilot deciding to eject from an aircraft, and an office worker arranging his/her work station to avoid tripping hazards are all examples of evaluating a risk and acting to eliminate or reduce that risk.

Risk management can be a powerful tool for eliminating hazards and increasing both efficiency and effectiveness. ORM enables a decision-maker not only to do things right, but also to do the right thing. Bottomline - ORM is not just another buzzword, but truly an approach that can enhance mission accomplishment and protect very valuable resources - Air Force PEOPLE.

Copyright Superintendent of Documents, Military Airlift Command Sep/Oct 1999
Provided by ProQuest Information and Learning Company. All rights Reserved