The Enchanted Forest: Risk-led safety by Nigel Heaton and Paul Haley

The Enchanted Forest: Risk-led safety by Nigel Heaton and Paul Haley HK s Occupational Safety and Health (OSH) Ordinance (Cap 509) is built on European Union legislation (EU Council Directive 89/391/EEC) and reflects the UK s Health and Safety at Work (HSW) Act 1974. The philosophy of these laws is that organisations should identify OSH risks that affect their business operations, and apply appropriate controls in a way that fit local circumstances and conditions. The ultimate goal is self-regulation. However, many organisations equate managing OSH risk to opening a can of worms. They either prefer to keep the lid on and do nothing (not wise), or adopt a goal of compliance-led regulation. In the latter case, managers often look externally for an OSH Enchanted Forest where they hope to find compliance solutions to these challenges. On their return from such quests they are often equipped with a cacophony of risk management terms, as well as armed with diagnostic tools and administration methodologies. Whereby OSH risk management becomes a bolt-on function not a process for adding value and sustainability to the organisation. Some of these tools rely heavily on complex algorithms and logical constructs, which are based on hard data metrics, such as insurance actuarial tables. Although this external search may yield a quantitative approach comfort blanket, which senior executives may understand, for managing OSH risks, it tends to create a heavy drain on resources and bureaucratic burden. Add to this pressure for continuous improvement from employees, staff representatives, industry best practice and Labour Department guidance, consultants, civil litigation case precedent, insurance companies, or adverse media reports, organisations frequently fail to see the wood for the trees, and therefore needlessly go too far to control their OSH risks. The HK law was passed at a time (1997) when factories and industrial undertakings, such as manufacturing and construction, still dominated the economy, and greater numbers of people were injured. In the past 16 years, financial and service industries have become more dominant. As a result Cap 509 is being applied across more diverse sectors, so that this law of unintended consequences now encompasses minor injury outcomes in low hazard workplaces. As a comparison, in the UK a similar situation existed, which created a risk aversion culture side effect. Some managers lost the ability, or confidence, to interpret safety law requirements in low hazard workplaces, piling layer upon layer of needless compliance justified paperwork on managers,

flooding their management and operating systems. Subsequently UK authorities have been undertaking a number of root and branch reviews to simplify OSH and de-mystify it. One possible reason for the loss of confidence has been changes in the UK to civil procedure rules in 1998, the Woolf Report in 1999 and Access to Justice Act, which created a market for no-win no fee lawyers that put the fear of civil litigation into many organisations. No-win no fee lawyers are not permitted to operate in HK. The restriction has its origins in the ancient common law crime and tort of champerty and maintenance, but signs that the situation is changing can be found. Given the high cost of litigation those in the middle-income group whose means are above the limits of the Legal Aid Scheme and the Supplementary Legal Aid Scheme would have difficulty financing litigation. Therefore in May 2012 the Law Reform Commission issued a consultation paper that recommends lawyers should be allowed to use conditional fees in certain types of civil litigation, including personal injury, employees' compensation, professional negligence and product liability cases (http://www.hkreform.gov.hk/en/publications/conditional.htm). The number of litigation cases heard in HK courts has not significantly increased since Cap 509 was introduced. However, the presence of back up the hearse and let them smell the flowers type insurance sales pitches, and advertising by civil claims firms may give the perception that claims are increasing. Moreover, it is difficult to determine the true number of civil cases as many are settled out of court. What is known is that the establishment of no-win no-fee lawyers in the UK opened up the legal system to people who could not afford to seek civil remedy for work related injuries in the past and, pressure selling by ambulance chasing lawyers compounded fears of being sued. Subsequently a rush to improve safety controls and to comply with OSH legislation ensued, perhaps and rather cynically, so that these UK organisations would be a harder target for civil litigation lawyers. This situation may quite possibly be mirrored or repeated in HK should lawyers be permitted to charge conditional fees. Adding to this OSH compliance boiler room was the Common Sense, Common Safety Report by Lord Young in 2010. The report argued only the insurers stood between many organisations and bankruptcy following a successful civil claim. Insurance companies often point out what they believe to be intolerable levels of risk to a client to safeguard their exposure, putting further pressure on an organisation to improve its safety controls and ensure legislative compliance. This 2

advice arguably is considerably less obtainable when an organisation has clearly gone too far to control its OSH risks! The continuous improvement of safety controls, in the hope of reducing insurance premiums, or due to fear of enforcement, or civil litigation, is problematic. This continuous improvement approach will inevitably take organisations beyond what is reasonably practicable towards costly, needless and unreasonable responses to control risks. There must be a stopping point when the focus shifts from commensurate design and implementation of OSH controls, to monitoring and maintaining these controls. How low is ALARP? The ALARP at a Glance page on the UK s Health and Safety Executive (HSE) website tackles the concept of reducing risk to a point as low as reasonably practicable, and discusses four common myths about applying this test to forestall organisations implementing needless controls. These myths are summarised in Table 1, below: Table 1. ALARP Myths 1 To ensure risks are reduced ALARP means continually raising OSH standards/controls 2 If several organisations have adopted a high standard of risk control, that standard is ALARP 3 Ensuring that risks are reduced ALARP means that organisations must insist on all possible risk controls 4 Ensuring that risks are reduced ALARP means that there will be no accidents or ill-health Spirit of the law (Source:- http://www.hse.gov.uk/risk/theory/alarpglance.htm) Proportionate controls/ improvements are encouraged. Feasible improvements do not make them reasonably practicable. Grossly disproportionate improvement costs vs. benefits accrued from such improvements are unreasonable. Reduction of risk levels may justify using fewer controls. Organisations should not adopt the same controls as others but should apply appropriate controls in a way that fits their business operational circumstances and conditions. There is more than one approach to achieve ALARP levels and many reasons why organisations adopt greater risk controls commensurate to their business operation. One size does not, and should not, fit all. It is not required to reduce OSH risks to as low as practicable or so far as practicable by using all possible risk control measures but to use controls that are risk commensurate. Grossly disproportionate improvement costs vs. benefits accrued from such improvements are unreasonable. ALARP does not mean zero risk. Stopping the activity or removing the hazard eliminates risk. Circumstances on the day or momentary lapses can cause accidents. 3

In our experience two further common OSH myths may be added to the HSE list: 1. Following an accident the organisation must change its risk control strategy; and 2. Accidents not covered by a risk assessment signify the organisation failed to comply with legislative requirements. Even robust controls may not prevent the circumstances on the day, or momentary lapses, causing an accident. It is therefore appropriate, and entirely reasonable, for a post accident investigation to correctly conclude that no changes to the risk control strategy are needed. This is an uncomfortable fact of managing OSH risks that many managers find difficult to reconcile. Failing to examine OSH incidents in context can also lead to unnecessary changes in risk control measures. For example, an event organiser may show that a slip incident in an exhibition or convention was one of five reported in the past 24 months. Moreover, during the same period more than a million visitors walked safely through the event location. These facts, set in context, may be convincing evidence that slip controls at the events are working more than reasonably well. The OSH risk assessment process is also in part a prediction, and so, despite the assistance of complex algorithms and metrics, there is no absolute certainty over what might happen. Events may turn out differently from the way predicted, or the accident is simply weird or bizarre, and therefore unpredictable. Another uncomfortable fact of life for some managers is, following an accident not covered by a predictive risk assessment the organisation may still comply with the legislation. Providing that the organisation has a system for predicting risk, and has monitoring systems, that fill gaps and incorporate lessons learned from the experience of an accident, the organisation may still demonstrate it is complying with OSH legislation. The HSE guidance supports the legislative philosophy that organisations can and should stop attempting to control risk more than is proportionate. The technique whereby this is achieved is to demonstrate competency in arriving at the choice of what controls are reasonably practicable, and commensurate, according to the prevailing circumstances and conditions. Compliance-led Organisations Many organisations are compliance-driven in their approach to OSH risk management. These organisations believe that the more compliant they are the less likely it is that they will be the 4

subject of enforcement action, and better able to defend spurious litigation. What they do not recognise is that Cap 509 is not prescriptive, and its accompanying regulations contain imprecise requirements. This makes it challenging for managers, senior executives and the C-suite to know when the organisation is compliant, and may leave the management team at the mercy of insurers or consultants conjuring up worst-case scenarios of non-compliance to extract fees. Figure 1. Compliance-led OSH Management System Monitor Audit Risk Assessment Hazard Inspections OSH Policies Workplace Safety Safety Systems Equipment Safety Compliance Training Competency Incident Investigations Laws Regulations Codes of Practice Industry Guidance Staff Consultation Figure 1 shows different areas of OSH compliance. The undetermined boundaries and complex overlapping in Figure 1 reflects how some organisations may easily and needlessly add risk controls such as, more refresher training, purchase of better equipment, and so on, in pursuit of compliance. A lack of understanding of stopping lines will inevitably take the organisation beyond what is reasonably practicable, towards unnecessary or unreasonable levels of risk control. Many organisations also applied binary thinking to the European law (EU Council Directive 89/391/EEC) leading to organisations believing they must complete OSH risk assessments - a red herring. This also demonstrated how compliance was central to the interpretation of OSH law by organisations. Many of which undertook needless risk assessments, often of petty tasks and activities, or trivialised the process by compiling endless hazard checklists to demonstrate they were managing their OSH risks. These volumes often ended up on the bottom shelf of storerooms 5

or were used as doorstops an Enchanted Forest for some maybe, but certainly not the intention of OSH laws. Not until European Court of Justice ECJ Case C-127/05 regarding the 'so far as is reasonable practicable' clarification in 2005 did many organisation realise the waste on resources committed to compiling risk assessments in the mistaken pursuit of compliance. The judgement reinforced selfregulation as the intended philosophy behind the law, and confirmed being risk- led by undertaking risk identification, assessment and control was key to achieving precision, and avoiding needless bureaucracy in an OSH risk management system the Enchanted Forest! Risk-led Organisations Being risk-led is much more than having risk assessments. Risk-led organisations place risk assessment at the heart of an OSH management strategy. This establishes a systematic method for identifying and mitigating risks that affect operations across the organisation and business. The approach uses employees who fully understand its culture, the way it operates and issues it faces, which ensures issues are not overlooked, as well as a degree of certainty that the most significant risks the organisation faces are identified. Organisations that are risk-led design more precise policies, develop specific procedures, define competency standards and dictate precisely what is required in a training syllabus. As a result compliance becomes simpler, finite and achievable. Figure 2. Risk-led OSH Management System Policy Competency Procedure Monitoring Compliance Risk Assessment Incident Investigation Audit Unlike compliance-led OSH risk management, a risk-led system is resource and energy efficient. By identifying and proportionately acting to control significant OSH risks in its business operation, an organisation is able to demonstrate legal compliance as well as identify when it should act and 6

how much needs to be done. Management Boards are then able to compare different business risks across the organisation, and take informed decisions; ensuring commensurate resources are deployed at the right place and time. Surely this is the OSH Enchanted Forest that organisations should be seeking. In summary Modern OSH legislation is often imprecise. This allows organisations flexibility to identify risks across their business, and apply appropriate and commensurate controls that fit local circumstances and conditions. Imprecise interpretation of OSH law leads organisations to look outside instead of inside for solutions, often becoming compliance obsessed and buried in paperwork. Organisations may develop an unhealthy reliance on outsiders who are unlikely to fully understand its culture, the way it operates and issues it faces. Being Risk-led organisations reduce bureaucracy, and compliance becomes simpler, finite and achievable. Call to Action Managers should know, based on evidence, what activities undertaken by their team give rise to most risk. For those activities, managers must provide assurance that the risk is reduced to a tolerable level. If a manager is not satisfied that the risk is tolerable, there must be an SMART action plan to reduce the risk. Managers must review and monitor the risk and its controls to ensure that the situation remains tolerable. Then and only then are you managing OSH risks. 7