Risk Management in

Engineering (49006)
Faculty of Engineering and IT
Introduction to Risk
Management
49006 Outline
• Risk Terminologies
• Risk Management Process, Standards, Plans
• Systems Thinking and Reliability Engineering
• Risk Assessment Process and Techniques
• Risk Evaluation and Treatment
• Risk-based Decision Making
• Risk Communication
• Special Topics: Natural Hazards, Domino Effects, and Natechs
 4

About me: Dr Emily Canda

Assoc Degree Civil Eng (Drafting), Civil Engineering Bachelors
(Honours), PhD Civil Engineering

Expertise: Sustainable concrete, Infrastructure project management,

Risk Management, Innovation in Infrastructure

Projects:
•Alternative Fuels Consumption - Berrima, NSW
•Soft plastic JV Recycling plant - Picton, NSW
•Australian National Quarry Dust Regulation - Australia
•Tarong Power Plant Upgrade - Tarong - QLD
•Sydney Metro Tunnel - Sydney, NSW
•Warringah Freeway, Sydney Harbour Bridge extension - Sydney, NSW
 5

Contact

• Email 49006@[Link]
• 72 Hour extensions exist via Canvas, anything over 72 hours
requires a medical cert
• Please ask your tutors questions in class
• Groups for Assignment 2 will be made in class
• Do not Teams message as this will not be checked
 6

Assignments:

• Assessment Task 1: Topic and Case Study Analysis: Due 24 Aug at 23:59 - 20%
• Assessment Task 3: Draft Quantitative Risk Assessment and Decision Making: Due 7 Sep - Not
graded
• Assessment Task 2: Risk Management Plan (Group or Ind): Due 5 Oct at 23:59 - 30%
• Assessment Task 3A&B: Quantitative Risk Assessment and Decision Making: Due 26 Oct at
23:59 - 50%
 7

Risk Management History

▪ In 2500 BC, Chinese had already reduced risks associated with the boat transportation of
grains by dividing and distributing their valuable load between six boats instead of one.
▪ The ancient Egyptians (1600 BC) had identified and recognized the risks involved by the
fumes released during the fusion of gold and silver.
▪ Hippocrates (460–377 BC), father of modern medicine, had already established links
between respiratory problems of stonemasons and their activity.
▪ Since then, the management of risks has continued to evolve.
 8

Risk Management History

▪ Pliny the Younger (1st century AD) described illnesses among slaves.
▪ In 1472, Dr. Ellenbog of Augsburg wrote an eight-page note on the hazards of silver,
mercury and lead vapors.
▪ Ailments of the lungs found in miners were described extensively in 1556 by Georg Bauer,
writing under the name “Agricola”.
▪ Dating from 1667 and resulting from the great fire that destroyed a part of London, the first
Fire Insurance Act was published.
▪ More recent, the essence of risk was formulated by Arnaud as early as 1662: “Fear of harm
should be proportional not merely to the gravity of the harm, but also to the probability of
the event”.
 9

Risk Management History

▪ Frank Knight even defines risk in 1921 as a “measurable uncertainty”.

▪ Today, the word “risk” is used in everyday speech to describe the probability of loss, either
economic or otherwise, or the likelihood of accidents of some type.
▪ Nowadays, the management of risk is a decision-making process aimed at achieving
predetermined goals by reducing the number of losses of people, equipment and materials
caused by accidents possibly happening while trying to achieve those goals.
▪ What still remains to be discovered in risk management and risk engineering is rather systemic
and more complex.
 10

Human Needs and Safety Importance

➢ Human needs and wants for certainty can be

divided into in five fundamental classes.
➢ Engineering risk management (ERM) is right after
basic needs and is essential for any organization’s
well-being and for its continuous improvement.
 11

Management Systems

There are two broad categories of management systems:

1. Business Management Systems
2. Risk Management Systems
 12

Business Management Systems

➢ Business management systems are concerned with developing, deploying and executing
business strategies.
➢ Business management systems specifically aim at improving the quality or business
performance of an organization, through the optimization of stakeholder satisfaction, with a
focus on clients such as ISO Standard 9001:2008 or extended to other stakeholders (e.g.
employees, society, shareholders, etc.) such as the EFQM 2010 Model for Business
Excellence or the ISO 9004:2009 Guidelines.
 13

Risk Management Systems

➢ Risk management systems focus on reducing risks of safety, health, environmental, security
and ethical.
➢ Some of the most popular generic examples of risk management systems are:
▪ International standard for environmental management ISO 14001:2004.
▪ European Eco-Management and Audit Scheme EMAS.
▪ International standard for occupational safety and health OHSAS 18001:2007.
▪ International standard for integrity management SA 8000.
▪ ISO 45001 Occupational Health and Safety Management Systems Requirements.
 14

Integrated Management Systems

➢ The boundaries of those two management systems are to fade in recent years. Therefore,
integrated risk management models have emerged:
▪ Recognizing the positive as well as the negative possible outcomes of risks.
▪ Considering all kinds of risks: operational, financial, strategic, juridical, etc.
▪ Surpassing compliance and continuous improvement.
▪ Canadian Integrated Risk Management Framework (2001)
▪ Australian-New Zealand standard AS/NZS 4360:2004, which served as the basis for the
development of the generic ISO Risk Management Standard 31000:2009.
 15

Managing Risks and Uncertainties

➢ A risk is defined by AS ISO 31000 as “the effect of

uncertainties on (achieving) objectives”.
➢ The definition implies that risks (financial as well as
non- financial, technological) are two-sided:
• Negative risks if the outcome is negative,
• Positive risks if the outcome is positive.

Organizations should manage risks in a way that the negative outcomes are minimized
and that the positive outcomes are maximized, this is called risk management.
 16

Managing Risks and Uncertainties

➢ In current industrial practice, risk management is only focused on negative risks, and only
on avoiding losses, instead of simultaneously avoiding losses and producing gains.
➢ Risk managers have been appointed in organizations mainly to satisfy legislative
requirements or because of incidents and accidents that happened within firms; hence the
only risks that needed to be managed displayed possible negative consequences.
➢ Risks should be viewed from a holistic viewpoint, meaning that all relevant stakeholders
and experts should be involved in the risk management process.
➢ The end goal is to use all the right people and means, at the right time, to manage all
existing risks in the best possible way, whether the risks are positive or negative, or whether
they are known or not.
 17

Managing Risk and Uncertainties

➢ To manage uncertainties efficiently, a

composite of three building blocks
(knowledge and know-how, stakeholders
and expertise and mindset) are necessary.
➢ The right mindset, enough information and
the right people are essential to deal with
risks and uncertainties in efficient and
effective way.
 18

Mathematics and Risk Management Analogy

➢ Risk management can actually be compared

with mathematics.
➢ Both disciplines are commonly regarded as
“auxiliary science” domains, helping other “true
sciences” to get everything right.
➢ Mathematics is needed for correct laws in
physics, chemistry, etc., and risk management is
required for optimized applications in physics,
chemistry.
 19

Risks and Uncertainties Complexity

➢ Risk means different things to different people

at different times.
➢ As mentioned, one element characterizing risk
is the notion of uncertainty.
➢ This figure displays the uncertainty sandglass,
with SWOT elements situated within the
concept.
 20

The Focus of 49006

▪ The focus is on upper triangle, hazards, exposure

to hazards, and losses.
▪ If one of these elements is removed from this
triangle, there is no risk.
▪ The engineering aspects of risk management in
this subject focus on how to diminish, decrease or
soften as much as possible one of the three
elements or a combination thereof.
 21

Risks and Uncertainties Complexity

➢ There are three types of uncertainties can be identified:

▪ Type I uncertainties where a lot of historical data is available (from negative risk
viewpoint, affect individual employees, e.g. work-related accidents).
▪ Type II uncertainties where little or very little historical data is available (affect a company,
e.g. large explosions, internal domino effects).
▪ Type III uncertainties where no historical data is available (unprecedented and unseen
disasters, e.g. Seveso (Italy, 1976), Bhopal (India, 1984), 9/11 Terrorist Attacks (USA,
2001), Fukushima (Japan, 2011)).
 22

Risks and Uncertainties Complexity

➢ This figure illustrates in a qualitative way the

three uncertainty types of events as a function
of their frequency.
➢ Type I unwanted events can be regarded as
“occupational accidents” (e.g. accidents
resulting in the inability to work for several
days, accidents requiring first aid, etc.).
➢ Type II and Type III accidents can both be
categorized as “major accidents” (e.g. multiple
fatality accidents, accidents with huge
economic losses, etc.).
 23

Risks and Uncertainties Complexity

➢ Another way of explaining the distinction between

events:
▪ Events that we do not know from the past (they have never
occurred), and look at with closed minds “unknown
unknowns”.
▪ Events that we know from the past (we have certain
information or records about them), and look at with closed
minds “unknown knowns”.
▪ Events that we know from the past and have open minds
towards “known knowns”.
▪ Events that we do not know from the past, but which we
have open minds towards “known unknowns”.
 24

Black Swan (Type III events)

➢ “Black swan” is used to describe anything

“impossible or not existing”.
➢ Three main features of black swan events could be
identified:
▪ The event has extreme or major impact.
▪ The event is unexpected or not probable.
▪ After the occurrence of the event, explanations
are formulated making it predictable or
expectable.
 25

Black Swan (Type III events)

➢ The characteristics of a black swan event:

i. The first one is that human thought tries to explain an enormous amount of phenomena
whereas, in fact, it can explain a lot less than it believes it is able to explain.
ii. The second characteristic regards the consequences that its occurrence may have.
iii. The last characteristic deals with the boundaries of human knowledge and the belief that
it encompasses more that it really can.
 26

[Link]
Basic Concepts
 28

Hazards and Risks

➢ Hazard is defined as “The potential of a human, machine, equipment, process, material, or

physical factor to lead to an unwanted event possibly causing harm to people, environment,
assets or production”.
➢ (Negative) Risk is the possibility of loss (fatality, injury, damage, detriment, etc.) created by
exposure to one or more hazards, and can be calculated as:

Risk = (Likelihood or frequency of unwanted event) × (Severity of unwanted event consequences)

 29

Examples
Case Study
 31

Physical Description of Risk

➢ Risk is found at the interface, or at the cross section, of a hazard and a target.
 32

Physical Description of Risk

➢ A threat is the potential of a hazard to cause

damage.
➢ Risk is physically characterized by four elements:
• A hazard.
• One or many targets threatened by the hazard.
• The evaluation of the threat.
• The measures taken to reduce the threat.
 33

Physical Description of Risk

➢ The main difference between an incident and an accident is

generally defined by the importance of caused or sustained
damage.
➢ The notions of accident is defined as follows:
▪ Incident: An event that leads or could have led to an accident.
▪ Near-accident or near-miss: An incident that does not damage
health or leads to any deterioration or losses.
▪ Accident: An unexpected event that leads to health deterioration,
lesions, damages or other losses.
▪ Disaster: A major accident that is brutal and sudden and of an
enormous dimension.
 34

Simplified Interpretation of Risk

➢ Risk cannot be felt by human senses; it can be only measured or estimated.

➢ The simplest model defines that the probability of a certain risk depends on:
▪ The frequency by which the target is exposed to the hazard (sometimes called likelihood of
occurrence), supposing that the hazard threatens the target.
▪ The evaluation of its consequence corresponding to a measurement of the severity of the mentioned
consequences.
Risk = frequency × severity
R=F·G
 35

Risk Calculation

➢ A simple mathematical representation of risk (expected loss) is the form commonly found in the
literature as:

𝐶𝑜𝑛𝑠𝑒𝑞𝑢𝑒𝑛𝑐𝑒 𝐸𝑣𝑒𝑛𝑡 𝐶𝑜𝑛𝑠𝑒𝑞𝑢𝑒𝑛𝑐𝑒

𝑅𝑖𝑠𝑘 = 𝐹𝑟𝑒𝑞𝑢𝑒𝑛𝑐𝑦 ∗ 𝑆𝑒𝑣𝑒𝑟𝑖𝑡𝑦
𝑈𝑛𝑖𝑡 𝑜𝑓 𝑡𝑖𝑚𝑒 𝑜𝑟 𝑠𝑝𝑎𝑐𝑒 𝑈𝑛𝑖𝑡 𝑜𝑓 𝑡𝑖𝑚𝑒 𝑜𝑟 𝑠𝑝𝑎𝑐𝑒 𝐸𝑣𝑒𝑛𝑡

➢ Example: Annual fatality risk due to automobile accidents in US:

6 𝑎𝑐𝑐𝑖𝑑𝑒𝑛𝑡𝑠 𝑓𝑎𝑡𝑎𝑙𝑖𝑡𝑦 𝑓𝑎𝑡𝑎𝑙𝑖𝑡𝑖𝑒𝑠

15 ∗ 10 ∗1 = 50,000
𝑦𝑒𝑎𝑟 300 𝑎𝑐𝑐𝑖𝑑𝑒𝑛𝑡𝑠 𝑦𝑒𝑎𝑟
 36

Risk Calculation

➢ Such an equation of risk is very convenient for many purposes, but it also creates several
difficulties:
▪ Determining the units in which risk is measured: Risk can be expressed in terms of number of
fatalities, the monetary losses per unit of time, the probability of certain injuries to people, the
probability of a certain level of damage to the environment, etc.
▪ In some cases, especially in Type II and III events, it is obviously very difficult to estimate the
likelihood of a given unwanted event and the magnitude of its consequences.
 37

Risk Calculation

➢ It is essential to realize that a risk value is always relative, never absolute, and that risk values
should always be compared with other risk values, to make risk management decisions.
➢ By looking at the likelihood values and the consequence values, and taking all the many
aspects into consideration, it is possible to put different kinds of risk in to proper perspective.
This is important as the risk value may depend on the viewpoint from which it is looked at.
➢ As an example, if the safety record of an individual airplane is, on average, 1 accident in every
10,000,000 flights, engineers may deem air travel to be a reliable form of transport with an
acceptable level of risk. However, when all the flights of all the airplanes around the world are
accumulated, the probability is that several airplane crashes will occur each year – a situation
borne out of observed events. Each crash, however, is clearly unacceptable to the public, in
general, and to the people involved in the crashes, in particular.
 38

Simplified Interpretation of Risk

➢ To be consistent with the concept that measures have been taken against a threat, the
notions of protection and prevention are taken into account in the following formula:

The likelihood of occurrence F depends on: Severity G is function of:

N – number of set targets D – “crude” hazard of the situation
T – average exposure time of each target at risk Pro – level of protection implemented in the light of this hazard
Pre – prevention implemented to reduce N or T
 41

Simplified Interpretation of Risk

➢ The evaluation of risk can be presented in a

matrix:
 42

Simplified Interpretation of Risk

➢The quantification of risk does not easily indicate something about

occurrence and severity. The illustration can help to understand
different classes of risk:
▪ A – low probability, low damage = low risk
▪ B – high probability, low damage = medium risk
▪ C – low probability, high damage = medium risk
▪ D – high probability, high damage = high risk
 43

Example: Fall from a Cliff

• D = height of the cliff, ground, slippery ground on top of the cliff

• Pre = level of protective fences, warnings signs
• Pro = being secured with a rope, having a loose soil or water
• T = average time for a walk along the cliff
• N = number of people walking along the cliff
Engineering Risk
Management (ERM)
 48

ERM – AS/NZS
ISO 31000:2009
 49

ERM – AS/NZS ISO 31000:2009

➢ For risk management to be effective, an organization should at all levels comply with the
principles of AS/NZS ISO 31000:
❖ RM creates and protects value.
❖ RM is an integral part of all organizational processes (not a stand-alone activity).
❖ RM is part of decision-making.
❖ RM explicitly addresses uncertainty.
❖ RM is systematic, structured and timely.
❖ RM is based on the best available information.
 50

ERM – AS/NZS ISO 31000:2009

➢ AS/NZS ISO 31000 principles (continued):

❖ RM is tailored and is aligned with the organization’s external and internal context and risk
profile.
❖ RM takes human and cultural factors into account.
❖ RM is transparent and inclusive.
❖ RM is dynamic, iterative and responsive to change (RM continually senses and responds
to change).
❖ RM facilitates continual improvement of the organization.
 51

Objectives and Importance of ERM

➢ The objectives of ERM are defined as: “the early and continuous identification, assessment,
and resolution of non-financial risks such that the most effective and efficient decisions can
be taken to manage these risks”.
➢ ERM offers an answer to the ever more difficult task of managing the risks of organizational
systems, technology, infrastructure, etc.
➢ Early and continuous risk identification, risk-informed (risk-based) decision-making, gaining
a systemic overview of an organization, proactive planning for unwanted events, proactive
learning and learning from incidents, intelligent resource allocation, situational awareness
and risk trends, etc.
 52

Objectives and Importance of ERM

➢ Well-known management disciplines of ERM:

❖ Operation management (ERM of operations)
❖ Change management (ERM of changes)
❖ Project management (ERM of projects)
❖ Crisis management (ERM of crises)
❖ Innovation management (ERM of innovations)
❖ etc
 53

How Much Risk

Management
 54

Summary

➢ The only certain thing about future is that everything is uncertain.

➢ Risks need three factors: hazards, losses and exposure.
➢ Decreasing (or even avoiding or taking away) one of these
parameters, or (one of) the characteristics of these parameters,
in one way or another, leads to lower risks (or even to no risk).
➢ AS/NZS ISO 31000:2009 provides the risk management
process, principles, and values.
Thank you!