Do you know what factors influence risk in your organisation?
When something goes wrong, it’s because a number of factors aren’t working – do you know what factors influence risk in your organisation?. This post discusses a range of examples from high profile incidents and introduces an approach for identifying and assessing the factors that influence organisational risk.
When something goes wrong in an organisation, there is a temptation to blame the person or team closest to that event. However, real life is not that simple as the investigations into Mid Staffordshire NHS Foundation Trust, the loss of the RAF Nimrod MR2 aircraft and the explosion at the Buncefield oil storage depot all show. For an accident to happen, many factors are likely to have gone wrong. However, knowing that this is the case doesn’t necessarily help us to prevent such accidents in the future unless we use the right tools such as those described in this post.
This begs the fundamental question: Do you know what factors influence risk in your organisation?
A large number of factors weren’t working in high profile incidents
James Reason(1) proposed the ‘Swiss Cheese Model’ as a concept to explain accident causation. This model suggests that, although many layers of ‘defence’ (e.g. procedures, training, risk assessments, etc) lie between hazards and accidents, there are flaws in each layer that, if aligned, can allow the accident to occur. That is, a number or factors need to go wrong simultaneously for an accident to occur.
Recent high profile incidents were subject to rigorous investigations illustrate this concept. In the brief descriptions that follow, we have highlighted in bold the factors where something went wrong.
In the report of the Mid Staffordshire NHS Foundation Trust Public Inquiry(2), Robert Francis QC noted that numerous warning signs had been identified which cumulatively, or in some cases singly, could and should have alerted the system to the problems developing at the Trust. He then noted that this had a number of causes, among them:
- A culture focused on doing the system’s business, not that of the patients
- An institutional culture which ascribed more weight to positive information about the service than to information capable of implying cause for concern
- Standards and methods of measuring compliance which did not focus on the effect of a service on patients
- Too great a degree of tolerance of poor standards and of risk to patients
- A failure of communication between the many agencies to share their knowledge of concerns
- Assumptions that monitoring, performance management or intervention was the responsibility of someone else
- A failure to tackle challenges to the building up of a positive culture, in nursing in particular but also within the medical profession
- A failure to appreciate until recently the risk of disruptive loss of corporate memory and focus resulting from repeated, multi-level reorganisation
In the report into the loss of the RAF Nimrod aircraft over Afghanistan(3), Charles Haddon-Cave QC identified a series of shortcomings including:
- A failure to adhere to basic principles
- A military airworthiness system that is not fit for purpose
- A safety case regime which is ineffective and wasteful
- An inadequate appreciation of the needs of aged aircraft
- A series of weaknesses in the area of personnel
- An unsatisfactory relationship between the MOD and Industry
- An unacceptable procurement process leading to serial delays and cost-overruns
- A safety culture that has allowed ‘business’ to eclipse airworthiness
The report into the underlying causes of the explosion and fire at the Buncefield oil storage depot(4) stated that failures of design and maintenance in both the overfill protection systems and liquid containment systems were the technical causes of the initial explosion and the seepage of pollutants to the environment in its aftermath. The report also noted that underlying these immediate failings lay root causes based in broader management failings:
- Management systems in place at the depot relating to tank filling were both deficient and not properly followed – despite the fact that the systems were independently audited
- Pressures on staff had been increasing before the incident – the site was fed by three pipelines, two of which control room staff had little control over in terms of flow rates and timing of receipt; this meant that staff did not have sufficient information easily available to them to manage precisely the storage of incoming fuel
- Throughput had increased at the site and this put more pressure on site management and staff – and further degraded their ability to monitor the receipt and storage of fuel; the pressure on staff was made worse by a lack of engineering support from Head Office
- Cumulatively, these pressures created a culture where keeping the process operating was the primary focus – and process safety did not get the attention, resources or priority that it required
For illustrative purposes, we have only considered three incidents, but common factors are emerging despite the diverse range of industry sectors (hospitals, military aircraft and fuel storage). In particular, all three investigations found that cultures had developed where the requirements of day-to-day business were viewed as being more important than addressing fundamental risk issues.
We need to know which factors influence risk in our organisations and how important those factors are …
Knowing that many factors have to go wrong to cause an incident is useful, and general lessons can be learned. However, this doesn’t necessarily help us to prevent such incidents happening in our organisations in the future unless we understand the risk factors.
We need to know:
- which factors influence risk in our organisations;
- how important those factors are; and
- how good those factors are at the moment
before we can deal with them.
The Influence Network provides a means to evaluate the factors that influence risk in your organisation
The Influence Network(5) recognises that a range of factors influence risk in an organisation. It uses typical factors that influence risk based on research and industrial experience. To model these influences, the Influence Network has adopted the following hierarchy:
- Direct performance factors – these directly influence the likelihood of an accident being caused
- Organisational factors – these influence direct factors and reflect the culture, procedures and behaviour within the organisation
- Strategy factors – these reflect the expectations of the decision makers in the organisation whose employees are at risk and the organisations they interface with (e.g. clients, suppliers, subcontractors)
- Environmental factors – these cover the wider political, regulatory, market, industry and social influences which impact the strategy factors
A typical Influence Network is shown in Figure 1. We can see that many of the factors highlighted in bold in the three incident investigations are reflected in the factors that make up the Influence Network – thus we can model their influence on risk.
Figure 1 Influence Network for risk
The technique has been used in over 30 workshops for the Health and Safety Executive, other regulators and companies in a range of sectors including construction, agriculture, waste, rail, shipping and offshore oil and gas. In construction, it has been used to investigate work at height, construction plant, goods deliveries, road works, hand-arm vibration mechanisms, HSE’s regulatory approach, the construction of London 2012 and the implementation of CDM 2007.
The Influence Network allows workshop participants to have a structured discussion about a range of possible factors that may or may not be influencing risk in a particular organisation. The Influence Network is customised to the particular organisation and risks under consideration. A workshop is held with 6 to 12 people with a range of roles to gain insight from their different perspectives. The workshop participants are provided with briefing notes that define all of the relevant factors, and contain quality scales. The workshop participants determine the:
- Quality of each factor by comparing their organisation with behaviourally anchored ratings and scoring between 0 and 10 – this gives an indication of the current quality of these factors, the variation in that quality and the underlying reasons
- Importance of each factor by weighting its influence on each factor on the level above as zero or on a 5-point scale from low to high – this identifies those factors that have the most influence on risk
Organisations should then focus their effort on improving those factors that have the most influence and the lowest or most variable quality. A second workshop can be used to identify and appraise a range of interventions that will improve risk management and reduce risks.
This tool allows you to …
- Evaluate the main drivers of and influences on risk within your organisation
- Identify the weak spots and develop a range of cost-effective interventions to deal with them
- Tap into the experience and get buy-in from a wide range of staff by involving them in the workshops
- Identify potential risks indicators within your organisation
This will make your organisation more resilient and less likely to be caught out by risks.
We will develop this topic further in future blog posts.
- Reason J.: Managing the risks of organizational accidents, Aldershot, Ashgate, 1997
- Robert Francis QC: Report of the Mid Staffordshire NHS Foundation Trust Public Inquiry, HMSO, HC 947, February 2013
- Charles Haddon-Cave QC: An independent review into the broader issues surrounding the loss of the RAF Nimrod MR2 Aircraft XV230 in Afghanistan in 2006, The Nimrod Review, HMSO, 2009
- Competent Authority for the Control of Major Accident Hazards: The underlying causes of the explosion and fire at the Buncefield oil storage depot, Hemel Hempstead, Hertfordshire on 11 December 2005, Report 02/11, 2011
- BOMEL Limited: Improving health and safety in construction – Volume 6: Generic model for health and safety in construction, HSE Research Report 235, June 2004
Dr Mike Webster specialises in risk and regulation, and is a chartered engineer with over 30 years’ experience. He has led risk and regulatory projects in the UK, Europe, Far East and US, and has acted as an expert witness in the UK.
If you would like free access to Mike’s report Do you understand what factors influence risk in your organisation? and the accompanying Organisational Risk Benchmarking Tool click here.
If you would like to discuss this further, drop Mike a line at firstname.lastname@example.org or give him a call on +44 (0) 7969 957471.