Risk management (ISO 31000)

Risk management is the handling of uncertainty around meeting objectives: identifying risks, assessing them and executing a strategy to treat them.

ISO 31000 defines risk as “the effect of uncertainty on objectives”: it is characterized by the likelihood of occurrence and by the consequence, and the effect can be negative (an obstacle) or positive (an opportunity). This is the essential element of asset management decision-making: to create value from the assets, you have to manage the uncertainty that threatens the objectives.

Figure 1 — the continuous, four-step cycle of risk management.

Who is this for?

This article is for those who live with the consequences of the decisions made about risk: asset management lead · reliability engineer · maintenance manager · plant manager and shift supervisor · process engineer · HSE specialist · investment decision preparer.

Learning objectives

After reading this article you will be able to:

• tie every risk to the objective it threatens
• distinguish asset risk from asset management risk
• choose deliberately among the four basic responses (4-T)
• calibrate an n×n risk matrix and use it for decision-making
• run management of change as part of risk management

In brief

• Risk = the effect of uncertainty on objectives (ISO 31000). It can be negative and positive (an opportunity), and it is interpretable only relative to the objectives.
• Risk is characterized by likelihood × consequence; the score arises on the n×n matrix, and this is the basis of prioritization.
• 4-T model: tolerate · terminate · transfer · treat.
• The process is continuous, not annual or quarterly: identification → assessment → response → evaluation of the treatment, then round again.
• Management of change is a critical element of risk management, because every change can generate new, unforeseen risk.
• Risk-based decision-making is the central element of asset management and of enterprise risk management (ERM); it rests on robust asset knowledge and on senior management support.

What are risk and risk management?

According to ISO 31000, risk is the effect of uncertainty on objectives. In practice we describe a risk as a concrete event that either occurs or does not, together with its causes and consequences, and we typically quantify it with likelihood and consequence (see criticality analysis).

Two things are worth highlighting. First: risk is interpretable only relative to the objectives, so it is a common mistake to talk about risks without mentioning the goals. Second: the effect can be negative (an obstacle) or positive (an opportunity). People tend to write risk off as a necessary evil, yet the opportunities also have to be managed for the most favourable outcome.

We distinguish a number of risk types: strategic (economic, competitive), financial (exchange rate, interest rate), operational (project, safety), plus asset risk (the effect of uncertainty on the objectives related to the asset: condition, reliability, system integrity) and asset management risk (the effect of uncertainty on the asset management objectives: information and AM process risk). There is no good or bad risk assessment method; the categorization always rests on the objectives in question. Risks, like objectives, appear at different levels, and the lower-level ones can affect the strategic goals too. That is why it is worth applying enterprise risk management (ERM): handling risks in an integrated, uniform framework at organizational level.

Why is it worth managing risks?

Inadequate handling of risks can have a direct and catastrophic effect on safety, financial and operational objectives, with legal, reputational, environmental and social consequences. Four well-known cases show what happens when risk management fails:

• Fukushima Daiichi (2011): a radioactive release following an earthquake and tsunami; according to the investigation, the operator did not comply with the basic safety requirements.
• BP Deepwater Horizon (2010): more than 800 million litres of oil into the Gulf of Mexico; BP has so far paid $42.2 billion in fines and compensation.
• Data breaches: Yahoo (2016), Anthem (2015), eBay (2014).
• The 2008 financial crisis: the failure to manage risks led to a global collapse.

Risk moreover ripples on across types and levels, which is why identifying and handling it is a complex task:

Figure 2 — the escalation of a financial risk: the deferred asset replacement first becomes asset risk, then safety risk.

Effective risk management, by contrast, demonstrates compliance, increases trust in the organization, gives better decision-making, and opens up new opportunities, up to a step change in performance.

What is the 4-T model?

Figure 3 — the four basic risk management responses.

“Mitigation” is the most commonly used term, but there are four basic responses to a risk (the 4-T model):

• Tolerate: live with the risk if the level is within the risk appetite.
• Terminate: eliminate the risk, for example by dropping the risky activity.
• Transfer: assign a third party to handle it, for example through insurance.
• Treat: action to reduce the likelihood and/or the impact, together with contingency measures for the case of occurrence; this is actual mitigation. Choosing the action is not a free hand: industry practice prescribes a fixed hierarchy of controls (elimination → substitution → engineering protection → administrative control → personal protective equipment), reducing the risk as far as is reasonably practicable (ALARP). The details of execution are in operational risk assessment.

How does the risk management process work?

Risk management consists of four steps building on one another: identification, assessment, response, then evaluation of the effectiveness of the treatment, and the cycle restarts continuously (Figure 1).

1. Identifying risks: determining the risk related to the objective and recording it in the risk register (together with the risk map that gives an overview of the most important risks). Everyone takes part in identification; its methods are ad hoc and regular meetings, formal workshops and reviews.
2. Risk assessment: evaluating the likelihood and the consequence along the organizational criteria, with an n×n matrix; prioritizing the risks on the basis of the score (likelihood × consequence).
3. Risk response: determining the treatment action and its schedule according to the 4-T model. This is where risk management connects to asset management decision-making and planning: risks are important inputs to AM planning, and the treatment options differ in their resource demand.
4. Evaluating risk management: checking the effectiveness of the controls and of the process. The organization and the operating context change, so risks are dynamic and have to be reassessed.

Note

The risk matrix

Figure 4 — the n×n risk matrix is a prioritization tool.

The n×n matrix frequently used during assessment gives the likelihood and consequence scores on a 1–n scale. The scale comes with a detailed description for consistent scoring (for likelihood, for example: “the event is expected within 1 year”, or “occurs within 1–5 years”), and for the consequence with criteria tied to the organizational values: financial, environmental, safety and operational impact. The significance of the risk = likelihood × consequence, on the basis of which the risks can be prioritized. The matrix is thus a decision-making tool, and the scale always has to be tailored to the organization.

The red cells are therefore not labels but obligations. Once the organization has understood the risks threatening its strategic goals, it can identify the intolerable ones, and these unacceptable risks are what the identifying activities of the asset management plans have to be centred on.

Management of change and risk

Figure 5 — a change generates new risks, so risk assessment is a mandatory element of change management.

Organizations frequently modify their assets, structure and processes, but these changes can generate new, unforeseen risks. That is why risk management is a critical element of change management: good practice identifies and assesses the risks of the change already before approval and implementation, in consultation with the affected parties. A common mistake is to look only at the changes of one department and to forget the objectives of other units; a central HSE decision, for example, may void the warranty of the equipment concerned. The approval level is matched to the complexity of the change, and an emergency or temporary change may be given a faster route. (Its relative is process safety management of change (MoC).)

Risk-based decision-making

Risk supports asset management in four areas:

Area	What it gives	How it shows up in practice
Aligning objectives (vision)	a framework for prioritizing activities	the matrix aligns the plans with the goals
Transparent and consistent decision-making	uniform assessment criteria and risk appetite	the relative importance and urgency of the risks become comparable
Well-founded risk-based decision-making	robust risk assessment and asset knowledge	reliability strategy, maintenance scheduling, training
Long-term strategic perspective	visibility of the risks of the distant future	asset wear-out, long-lead replacement

Common mistakes

• Risk without an objective. Instead: for every risk, name which goal it threatens.
• Attending only to negative risk. Instead: put the opportunity (positive risk) into the register as well.
• An annual or quarterly campaign. Instead: a continuous cycle built into the business processes.
• A silo view at the change. Instead: examine the objectives of the affected units too, before approval.

When NOT to use it (the limits of the method)

This framework is for steering risks at organizational level, not for the technical uncovering of hazards.

• Never instead of hazard identification. If the question is what deviation leads where, HAZOP is for that; the required level of the protection layers is given by LOPA and SIL, not by the matrix score.
• Do not score on an uncalibrated scale. Without descriptions the score is opinion, and the prioritization shows false precision.
• Not without reliable asset knowledge. With incomplete condition and failure data the assessment of asset risks remains unfounded.
• Not with a single matrix at every level. Strategic and daily operational risk belong to different criteria and approval levels.

Industrial and safety context

Risk management is industry-independent (ISO 31000), but in the process industry it is directly tied to safety. The concrete techniques of the analysis are in the process safety and maintenance chapters of the knowledge base: HAZOP and LOPA and SIL for hazard identification and the protection layers, FMEA and criticality analysis for asset-level failure mode and risk assessment. This article is the AM-level framework above them, into which these fit as inputs; daily operational execution (workplace risk assessment, hierarchy of controls, permitting) is covered by operational risk assessment.

Putting it into practice

A one-hour first round you can start tomorrow morning:

1. Pick three objectives from your own area (availability, HSE performance, cost budget).
2. Enter one risk per objective into the risk register: what the event is, what its cause is, what its consequence is, and which goal it threatens.
3. Score all three on the calibrated likelihood and consequence scales; if there is no written scale description, write that first.
4. Designate the 4-T response, with an owner and a deadline; if the response is “treat”, choose the action in the order of the hierarchy of controls.
5. Set the review date, and tie it to change management: before a modification awaiting approval, the assessment must run again.

How does this show up in digital practice?

Risk management is alive when it is present not in a spreadsheet updated once a year, but in the daily systems.

Risk management principle	Digital implementation	What it gives
The risk is a tracked item	risk register with objective reference, owner and deadline	the risk is not lost between two meetings
The response becomes work	the treatment action turns into a CMMS work order	whether the action happened is measurable
The change forces an assessment	MoC approval workflow with a mandatory risk assessment step	the new risk surfaces before approval
The assessment is built on data	asset condition dashboard as the source of asset knowledge	the likelihood score rests on observation

Connection to OPEREX (shift log)

The shift log (OPEREX) records the daily risk observations (near-miss, abnormal condition, “schedule-breaking” event), and these are direct inputs of the risk register and of the reassessment. A temporary modification or bypass leaves a trace in the shift, which is the basis of the management-of-change (MoC) risk assessment. This way the high-level risk picture is fed from the daily reality.

Terminology (HU / EN)

Hungarian	English (canonical)	Note
Kockázatkezelés	Risk management	ISO 31000
Kockázat	Risk	the effect of uncertainty on the objective
Kockázattűrés	Risk appetite	the level of risk considered acceptable for the sake of the objectives
Eszközkockázat	Asset risk	the effect of uncertainty on the objectives related to the asset
Eszközgazdálkodási kockázat	Asset management risk	the effect of uncertainty on the asset management objectives
4-T modell	4-T model	Tolerate / Terminate / Transfer / Treat
Kockázati mátrix	Risk matrix	likelihood × consequence
Kockázati nyilvántartás	Risk register	identified risks, with actions
Társasági kockázatkezelés	Enterprise Risk Management (ERM)	integrated handling at organizational level
Lehetőség	Opportunity	positive risk

The terminology follows the usage of Uptime Elements and ISO 31000.

FAQ

What is risk management according to ISO 31000?

The handling of uncertainty around meeting objectives. ISO 31000 defines risk itself as “the effect of uncertainty on objectives”; it is characterized by likelihood and consequence, and it can be negative or positive.

What is the 4-T model?

The four basic risk responses: Tolerate (live with it), Terminate (eliminate it), Transfer (for example insurance), Treat (reduce the likelihood or the impact).

How does the risk management process work?

Four steps: identification (register), assessment (n×n matrix, likelihood × consequence), response (4-T, with a schedule), then evaluation of the effectiveness of the treatment. The cycle is continuous, not annual.

What is the difference between asset risk and asset management risk?

Asset risk is the effect of uncertainty on the objectives related to the asset (condition, reliability, system integrity), while asset management risk is that of the AM objectives (information, AM process).

Take it home (keys)

• No risk without an objective: every row of the register has to state which goal it threatens.
• Positive risk is risk too: opportunities have to be managed just as obstacles are.
• The matrix is a tool only if it is calibrated: without a written scale description the score is not comparable.
• A red cell is an obligation: the intolerable risks give the focus of the asset management plans.
• Management of change is part of risk management: the assessment runs before approval, in consultation with the affected units.
• The process is worth as much as the asset knowledge beneath it: good risk assessment cannot be built on bad data.

Self-test

1. The likelihood of one risk is 2, its consequence 5; another’s are 4 and 2. Which comes first in the prioritization?
2. Why is it a mistake to formulate a risk as “the pump may fail”?
3. The risk response is “treat”. In what order do you look for the action?

Answer key: 1) The first (2×5 = 10 > 4×2 = 8). · 2) Because the threatened objective and the consequence are not stated alongside it, so it cannot be scored or prioritized. · 3) Elimination, substitution, engineering protection, administrative control, personal protective equipment, reduced to the ALARP level.

Applied exercise

• Write three risks for the objectives of your area, marking the cause, the consequence and the 4-T response.

Related concepts

asset management and ISO 55000 | criticality analysis | operational risk assessment | HAZOP | LOPA and SIL | FMEA | management of change (MoC) | reliability strategy and RCM | long-term reliability program | reliability KPIs

Next step

The picture builds on in this order:

1. asset management and ISO 55000 — the framework in which risk becomes the input of decision-making.
2. criticality analysis — the asset-level ranking that tells you where to look first.
3. operational risk assessment — daily operational execution: workplace risk assessment and the hierarchy of controls.

References / further reading

• ISO 31000:2018 — Risk management. Guidelines: the canonical definition and principles of risk and risk management.
• ISO/IEC 31010 — Risk assessment techniques: the collection of risk assessment procedures (from HAZOP to FMEA).
• ISO 55000 / 55001 — the standard family of the asset management system, whose core is risk-based decision-making.
• Reliabilityweb.com: Uptime Elements — the reliability framework in which risk management appears as a standalone element (Certified Reliability Leader curriculum).