How is an acceptable level of risk achieved?

• A. Requires management and operating systems be put in place. Systems must incorporate Risk Mgt elements & practices to: Identify analyse & assess risk; Avoid or remove unacceptable level of risk; Monitor the level of risk and the adverse consequences of retained residual risk; Investigate & analyse the causes of serious accidents & HPIs to prevent reoccurrence; Review effectiveness of control measures & take appropriate corrective/preventative action; Mitigate the potential adverse effect of residual risk Prescribed through regulation
• B. By relying solely on PPE and training
• C. By ignoring residual risk and continuing operations
• D. By outsourcing risk management to an external consultant

Answer: (A)

Achieving an acceptable level of risk comes from a structured, ongoing risk management system embedded in how the operation is run. This means putting in place management and operating systems that include the full risk management process: identify, analyse and assess risks; avoid or eliminate risks that are unacceptable; monitor both the level of risk and the consequences of any remaining residual risk; investigate and analyse the causes of serious accidents and high-potential incidents to prevent recurrence; regularly review how well control measures work and take corrective or preventive actions; and mitigate the remaining residual risk as far as reasonably practicable. Regulation often prescribes these elements to ensure a proactive, accountable approach.

This integrated approach is necessary because risk isn’t solved by a single measure like PPE or training alone; it requires a system of controls, monitoring, and continuous improvement. Ignoring residual risk isn’t acceptable or safe, since some risk always remains even with controls. Outsourcing risk management doesn’t relieve the organization of responsibility or provide the necessary internal governance and ongoing oversight required by regulation.