SPE 86707
3D Model for Qualitative Risk Assessment
Robert S. Cram, Anadarko Algeria Corporation LLC
Copyright 2004, Society of Petroleum Engineers Inc.
This paper was prepared for presentation at The Seventh SPE International Conference on
Health, Safety, and Environment in Oil and Gas Exploration and Production held in Calgary,
Alberta, Canada, 29–31 March 2004.
This paper was selected for presentation by an SPE Program Committee following review of
information contained in a proposal submitted by the author(s). Contents of the paper, as
presented, have not been reviewed by the Society of Petroleum Engineers and are subject to
correction by the author(s). The material, as presented, does not necessarily reflect any
position of the Society of Petroleum Engineers, its officers, or members. Papers presented at
SPE meetings are subject to publication review by Editorial Committees of the Society of
Petroleum Engineers. Electronic reproduction, distribution, or storage of any part of this paper
for commercial purposes without the written consent of the Society of Petroleum Engineers is
prohibited. Permission to reproduce in print is restricted to a proposal of not more than 300
words; illustrations may not be copied. The proposal must contain conspicuous
acknowledgment of where and by whom the paper was presented. Write Librarian, SPE, P.O.
Box 833836, Richardson, TX 75083-3836, U.S.A., fax 01-972-952-9435.
Proposal
Conventional two dimensional qualitative risk assessment
defines risk as the probability of an event multiplied by the
consequence resulting from the event where the consequence
is loosely defined as discrete components ranging from no
consequence or minor consequence through to a catastrophe.
In human terms, this is usually either a fatality or permanent
disability.
Typically, this type of risk matrix is split into regions
indicating, for example, “unacceptable risk”, “acceptable risk”
and “investigation required” categories. In the case of events
involving risk to human beings, this type of approach is
insufficient as the potential outcome is always in the most
severe consequence category i.e. fatality or permanent
disability. Risk assessment for activities involving human
beings is therefore reduced to a one dimensional exercise
focusing solely on the probability of the event.
This paper describes a three dimensional approach to
qualitative risk assessment which permits acknowledgement of
the possibility for a catastrophic outcome and the same time
provides a mechanism for addressing measures to reduce such
a possibility to a minimum.
X-axis) represents the probability or the event occurring and
the other axis (Y-axis) represents the worst possible
consequence should the event occur.
Many organisations use a single matrix for qualitative risk
assessment to cover human, environmental and plant risks. In
such cases, the consequence axis bears multiple scales or
ranges depending on the category being assessed i.e. human,
environment or plant. Considerable diversity also exists in the
dimensions of the risk matrices used by different
organisations. Common risk matrices vary from a simple 3x3
matrix to larger 5x5 or more with various intermediate
permutations e.g. 3x4, 4x5 3x5. The consequence and
probability scales adopted also demonstrate considerable
variation. There is no standard set of definitions in general use.
Some risk assessment techniques express probabilities of
event occurrence in terms of Low, Medium or High while
others use numerical values. Consequence definitions also
vary widely. In human terms, the consequences normally
range from minor first aid up to permanent disability and
fatality while others may extend the consequence range to
include a multiple fatality level.
Some risk assessment models (1) are described as three
dimensional. These models incorporate the terms exposure,
likelihood and consequence. Such a breakdown has the
potential to be extremely useful however; exposure and
likelihood are normally only related to the probability of the
event occurrence. Models incorporating exposure and
likelihood are therefore not truly three dimensional. This is not
to say that there is not a need for such definitions rather that
their combined use does not necessarily render the model 3D.
In some instances, exposure is equally applicable to the
probability of the consequence. It would be perfectly valid to
develop a risk cube where the probabilities of both the event
and the consequence were derived using exposure and
likelihood in both cases.
By introducing a 3rd axis - “probability of consequence”,
the risk matrix becomes a risk cube. Each layer of the cube
represents a level of consequence with the other two axes
representing the probability of the event and the probability of
the consequence occurring.
A two dimensional matrix has been developed which looks
at the probability of harm vs. severity (2) however this model
does not take into consideration the probability of the initial
event.
Introduction
Risk is defined as the probability of an event occurring times
the worst possible consequence. The product of these two
factors is then plotted on a matrix where one axis (usually the
A conventional risk assessment meeting involves a team of
knowledgeable people representing the different groups who
will be involved in the supervision or execution of the task.
The usual agenda normally includes:-
2
SPE 86707
•
Identification of Hazards,
•
Estimation of potential consequences
•
Estimation of the probabilities of such events occurring
•
Evaluation of the risks
•
Identification of mitigation procedures
•
Re-evaluation of the residual risk
This group may often (but not always) include a specialist
from the Health, Safety & Environment department.
The principal outcome from a risk assessment meeting is
to identify measures which will reduce the perceived risks to a
level defined As Low As Reasonably Practicable. It is often
quite practical to reduce the potential consequence of an
incident in terms of environmental or equipment damage
through effective mitigation controls. Building a bund around
an area with large quantities of hazardous liquids will limit the
maximum consequence should a spill occur. Choice of
working practices or provision of emergency equipment can
and does have a significant impact on the maximum
consequence of an incident in terms of equipment damage.
It is not quite so straightforward when the human factor is
brought into the equation. Whenever human beings are
involved, it is not possible to state with certainty that the
residual risk of a fatality, permanent disability or major injury
has been eliminated. If we consider the two dimensional
matrix in Fig 1, a common error by inexperienced teams
conducting a risk assessment is to identify an estimated
residual risk (after all mitigation controls have been
established) which is less than catastrophic. By doing so, what
is effectively being stated is that the potential consequence of
the particular event under consideration can never be a fatality.
This is clearly not the case. The definition of the two
dimensional consequence axis is “potential consequence” and
there is always the possibility for a fatality with any activity
involving human beings.
Two examples, land transportation and personal protective
equipment are presented in the following sections to illustrate
the limitations of the two dimensional model of probability of
the event versus possible consequence in effective risk
assessment.
Land Transportation
“The greatest risk of mortality or morbidity for those who
travel abroad is the road traffic accident” (3). Driving or
travelling as a passenger in a road vehicle is the most
dangerous activity most of us will ever undertake. This is
especially true in the developing world where traffic discipline
is often less than in the developed world and the response of
the emergency services is not up to the same standard as most
of the developed nations. The mere fact of sitting in a parked
car makes it possible to be struck by another vehicle and
killed. Anyone could be sitting at a road junction waiting for
the lights to change when a truck turns the corner and a tyre
under maximum load bursts. The truck may slide out of
control and crash into their stationary vehicle. Result? There
have been too many instances of such collisions for us to
doubt the potential under any circumstances for a catastrophic
outcome. What this illustrates is that it is perfectly possible in
the motor vehicle collision scenario to do everything right, to
take every precaution and still end up with a fatality.
In light of the fact that a fatality is always possible
regardless of the precautions put in place, when using a
conventional two dimensional risk matrix, we are always
constrained to identify the residual risk in the same
consequence level as the initial risk. The only criterion we can
therefore affect is the probability of the collision occurring.
Assuming that many organisations have either identified the
topmost row of their two dimensional matrix to be
unacceptable, or at least requiring further investigation then
this obligation places us in the rather awkward position of
having to accept the potentially fatal risks from all land
vehicle transportation activities even though they fall outside
the acceptable risk zone on the risk matrix.
The next issue we face with the two dimensional approach
is that there is no scope to identify the benefits of protective
equipment. Regardless of what safety equipment we install in
the vehicles; air bags, seat belts front and rear, cargo nets,
head restraints etc, as we have seen above, we can never
eliminate the potential for a fatal vehicle collision. As none of
the measures described above have any effect on the
probability of the occurrence of the collision it is apparent that
our present approach to qualitative risk assessment using a two
dimensional model does not enable us to demonstrate the
advantages of any of these measures. Yet few would dispute
that they play a significant role in saving lives and reducing
injuries.
Personal Protective Equipment
The issues which have already been addressed in vehicle
protective equipment are equally applicable to the issues
surrounding the credit taken for Personal Protective
Equipment (PPE) in the workplace. PPE is normally regarded
as a last resort mechanism to mitigate the potential
consequence of an incident. This is however misleading. The
use of PPE can not totally eliminate the possibility of a
catastrophic outcome. It is not unusual to see in 2D job risk
matrices the residual risk potential being reduced from a
catastrophic consequence to minor or at worst major
consequence. Not only is this inaccurate but it has the adverse
effect of instilling a false sense of security among the
personnel involved in supervising or carrying out the work.
Quite understandably, personnel may assume that because a
risk assessment has been carried out and all the precautions
put in place to minimise the potential consequence that they
are no longer in any serious danger.
In actual fact, the use or otherwise of PPE does not have
any effect on the potential consequence following an incident.
It only has an effect on the probability of the potential
consequence being realised. Two examples are discussed
briefly below.
SPE 86707
Fall from a height
Working on the assumption that a risk assessment has been
carried out and all of the appropriate PPE has been issued
including a fall arrestor, it could be assumed that every aspect
of the individual’s safety when working at height had been
taken into account and that the residual risk would now be, for
example, minor injury.
Recent research (4) has shown that this is far from the
truth. People without any injury whatsoever have died from
Suspension Trauma despite all the precautions, establishing
that, although we have skewed the probability of the most
serious consequence, the maximum potential consequence is
still present.
Motor Vehicle Collision
Research has shown that lap/shoulder belts, when used
properly, reduce the risk of fatal injury to front-seat passenger
car occupants by 45 percent and the risk of moderate to critical
injury by 50 percent (5). The provision and correct use
therefore of PPE clearly does not eliminate the possibility of a
fatal outcome following an incident. It simply makes it more
unlikely. Conventional risk assessment matrices do not
facilitate acknowledgement of the benefits of vehicle
protective equipment.
Probability of consequence
As has been shown, the two dimensional risk matrix offers
insufficient flexibility when it comes to risk assessment for
activities involving human beings. The simple fact that the
outcome of an event can not be predicted with absolute
certainty means that the possibility for a catastrophic outcome
will always exist. With many activities historical statistics are
available and it is perfectly possible to determine a numerical
probability for the potential outcome from such an event. For
most activities in the workplace unfortunately, we do not have
the statistics to accurately predict the outcome.
It has already been stated that the use of PPE does not
eliminate the most severe potential consequence following an
incident. The risk is always in the catastrophic row; only the
probability of the event can be reduced. From two dimensions
therefore, we have been reduce to one. Put another way,
conventional 2D risk assessment obliges us to consider
elimination of the danger as the only acceptable mechanism to
reduce the risk of fatality or major injury for all human
activities.
One solution to this problem is to introduce a third
criterion, “Probability of Consequence”. Incorporating this
criterion enables us to address the beneficial effects of
protective equipment in risk mitigation. It has been clearly
demonstrated through numerous research studies that a direct
link exists between the correct use of vehicle PPE and the
probability of being killed in a vehicle collision. This is
equally true of incidents in the workplace. The introduction of
the probability of consequence, results in the creation of a risk
cube (Fig 2). The three axes of this cube are:-
3
•
Probability of the event
•
Consequence
•
Probability of consequence
It is now possible to incorporate the benefits of risk
mitigation factors such as PPE in the risk assessment exercise
while at the same time acknowledging that the potential
outcome for all activities involving human beings remains
catastrophic.
3D Risk assessment
In practical terms, any attempt to model risk on paper using a
three dimensional structure would suffer from significant
problems. The most notable of these are clarity and ease of
interpretation. A simple solution is to break the cube into
individual layers each of which represents a specific
consequence. The number of layers would equal the number of
discrete consequences defined by the organisation. An
example of a 3D risk assessment form is given in Figure 3.
The 4x4x4 dimensions were selected deliberately to prevent
inexperienced risk assessors from always selecting the middle
value as is often the case with an odd number of options.
In actual fact, just as with 2D matrices, there is no
constraint which obliges the number of layers to equal the
number of probability options. If required, a 4x4x5 structure
could be used. It is as valid to vary the dimension of the 3D
model as it is to vary a 2D model. Regardless of the number of
consequence layers each has axes corresponding to the
probability of the event occurring and the probability of a
particular consequence. An additional benefit to a three
dimensional approach is that it is possible to apply different
values to the Y-axis (probability of consequence). There is no
reason at all why the probability of a fatality needs to conform
to the same scale as the probability of a minor injury.
Certainly, it is not essential to define different probability
ranges, it is simply an option available which is not possible
using the two dimensional approach.
This flexibility in varying the probability of consequence
from one layer to another does not apply to the X-axis. The
probability of the event is the same for all layers and is fixed
for all possible outcomes.
Most two dimensional risk matrices are segregated into
three zones; unacceptable risk, investigation required and
acceptable risk (Fig 1). The boundaries of each zone are
however fixed for all probabilities and consequences. Using a
3D approach, different boundaries can (and should be) be
applied to each consequence layer. Tolerance levels will of
course vary from one organisation to another. It is for the
individual organisation to determine the boundaries of
unacceptability / investigation required / acceptability for each
of the consequence layers.
While a 3D approach to risk assessment does not attempt
in any way to fulfill the role of Quantitative Risk Assessment,
there is a small degree of freedom to define specific
4
SPE 86707
probability values to individual layers should this be deemed
appropriate.
3D risk assessment procedure
By it’s nature, a three dimensional approach is more
exhaustive and requires more time than a two dimensional
approach. Every mitigation measure needs to be assigned to
either reducing the probability of the event or reducing the
probability of the consequence of the event. An example
procedure is provided here which can be used in conjunction
with the form in Figure 3. Whether the organisation chooses to
retain personal injury, environmental and plant consequences
on the same form is purely optional. They have been included
together here for the sake of brevity.
Step 1 – Identify the Hazards and Risk Groups. This is
exactly the same irrespective of whether a 2D or a 3D risk
assessment is being conducted.
Step 2 - Involves the identification of the initial and
residual probabilities of the event occurrence. The initial event
probability is evaluated based on the opinion of the experts in
the team and is the probability that the event will occur if no
mitigating steps are taken.
Step 3 – Once the initial event probability has been
evaluated, precautions to reduce it should be identified. For
example:•
Reducing the number of vehicle journeys
•
Placing guard rails around high areas
•
Ensuring non slip floor surfaces are laid
Etc.
Precautions such as these do not affect the outcome of the
event. They do however have a direct impact on the probable
number of events. For example fewer vehicle journeys mean a
lower probability of a vehicle collision. This is one of the
reasons insurance companies (who have vast databases of
accident statistics) ask for the estimated annual mileage when
providing an insurance quotation.
Step 4 – When all of the precautions to reduce the
probability of occurrence have been identified, an estimate of
the residual probability can be determined. This is the value
which should be used in all of the consequence layers in the
next section of the 3D risk assessment form. It is not valid to
have different probabilities for the event in different
consequence layers.
a) – The first layer is the fatality or permanent disability
layer. This layer should have the highest unacceptable area. In
many instances, discrete colouring of individual boxes is used
as a mechanism to indicate acceptability ranges (Fig 1). For
three dimensional risk assessments, a gradated indication from
unacceptable to acceptable probabilities may be preferable.
This will depend on the tolerance levels of the particular
organisation and / or activity.
An estimation of the initial probability of a fatality or
permanent disability should be determined. This should be
marked in the appropriate square.
Once this has been done, precautions to reduce the
probability of this consequence should be addressed. It is not
necessarily the case that all precautions to prevent a fatality
will be equally applicable to all other layers. For example, in a
working at height scenario, the provision of a fall arrestor will
contribute to a reduction in the probability of being killed by a
fall and equally, it will reduce the probability of major, minor
and first aid injuries. It has however been shown that fatalities
can occur in individuals suspended in a harness even though
they have no injuries. Prompt rescue within 10 min. (6) is the
optimum precaution to reduce the probability of a fatality due
to suspension trauma but this in itself does not contribute to a
reduction in the probability of major, minor or first aid
outcomes and so is only applicable to the fatality layer.
All mitigating measures should be noted in the
corresponding column under the catastrophic layer.
When all precautions have been identified and noted, an
estimation of the residual risk should be made. This should be
indicated immediately below the initial risk. The residual risk
should always appear in the same column as the initial risk as
the residual probability of the event has already been
established and it does not change as the result of identifying
measures to reduce the probability of the consequence.
b) - Once every measure has been identified to minimise
the probability of a catastrophic consequence, the other layers
should be addressed. For each in turn, the team should first
identify the initial probability of the outcome and mark it in
the appropriate matrix. Again, after identifying the initial risk,
precautions to reduce the probability of each consequence
should be identified and noted in the corresponding columns.
Step 5 – Once the appropriate column for event probability
has been identified, attention should be focused on the
individual consequence layers in the model.
It is unnecessary to repeat precautions which have been
identified in a higher consequence layer. There will however
be precautions which are specific to one particular outcome
which would not be applicable in preventing more serious
consequences. A simple example is the provision of work
gloves. By themselves, they contribute to reducing the
possibility of a first aid or minor injury but are not normally
effective mitigation measures to prevent a fatality.
Each of the consequence layers has two axes; Probability
of Event (already determined and fixed) and Probability of
Consequence i.e. the probability that the outcome of the event
will be in that particular layer
Finally, the residual probability for the remaining
consequence layers should be indicated in the appropriate
matrices. As with the catastrophic consequence, the same
residual event probability should be used throughout.
SPE 86707
Environmental and Plant Risk Assessment
Most of the focus so far has been on risk assessment in the
context of harm to people. The layered consequence model is
equally applicable to both environmental and equipment risks.
As with a conventional matrix, multiple severity categories
can be used on the same layers. Alternatively, separate sheets
can be produced with specific probability scales and
acceptability regions.
Regardless of whether a single sheet is used for all types of
risk, or whether specific sheets are developed, the procedure
for carrying out environmental and equipment risk assessment
remains the same as described for personnel risks.
Conclusions
Two dimensional consequence versus event probability risk
matrices are insufficient to model the effects of protective
measures especially in terms of risk to personnel. In the
human situation, the conventional risk matrix is reduced in all
cases to the catastrophic top row of the matrix and the risk
assessment exercise is effectively reduced to answering one
over simplistic question “What is the probability of a fatality
or permanent disability?”
The inclusion of a 3rd axis – Probability of Consequence
enables the effects of protective equipment and other
mitigating procedures to be incorporated into the risk
assessment process. This has the benefit of increasing the
awareness of the team to the constant possibility of a fatality /
permanent disability while at the same time enabling them to
continue to operate within the constraints of a potential
catastrophic outcome for all events involving personnel.
Acknowledgements
The author would like to thank Anadarko Algeria Corporation
for permission to publish this paper.
References
1.
Risk Management Office, University of Melbourne;
Environment, Health & Safety Manual, Hazard Identification,
Assessment and Control (May 2000)
2.
American National Standards Institute, Risk Assessment and
Risk Reduction - A Guide to Estimate, Evaluate and Reduce
Risks Associated with Machine Tools, ANSI B11.TR3-2000
3.
Professor David Warrell, Head of the Nuffield Department of
Clinical Medicine, Oxford.
4.
Weems, B. et al.: “Will your safety harness kill you?”
Occupational Health & Safety magazine, Vol. 27, No. 3, Mar.
2003, 86-90
5.
US Dept. of Transportation, National Highway Traffic Safety
Administration, “Occupant Protection”, Traffic Safety Facts
1994.
6
Greenfield, J., Suspension Trauma?, Who is at risk?, Institute of
Occupational Safety and Health & Health and Safety Executive,
Safe Working at Height Conference, Aston Villa Football Club,
Birmingham, Oct. 2002
5
6
SPE 86707
Figure 1
2D Risk Assessment Matrix (injury)
1
Major injury requiring
hospital stay
2
Injury requiring treatment
beyond first aid
First aid event
Category
Fatality or permanent
disability
3
4
VL
Figure 2
L
M
Probability or event
H
SPE 86707
7
Figure 3
Risk Assessment Form for 3D model
Department
Task Description
Risk Assessment Ref:
Area / Zone Assessed
Work Description
Hazard Description
Hazard Category
Risk Groups
Initial Event Probability V. Low
Low
Medium
High
Precautions taken to reduce the probability of the event occurring
Residual Event Probability
V. Low
Low
Medium
High
Use the same Residual Event Probability in each of the Cube Layers below
Consequence Layers
L
VL
M
L
VL
VL
L
M
H
Probability of Event
H
M
L
VL
VL
L
M
H
Probability of Event
Plant / Prod. Loss
<$5K
Environmental damage
<$5K
First Aid
Probability of
Consequence
M
H
Plant / Prod. Loss $5K $249K
Environmental damage
$5K - $249K
Minor Injury
Probability of
Consequence
H
Plant / Prod. Loss $250K $1M
Environmental damage
$250K - $1M
Major Injury
Probability of
Consequence
Probability of
Consequence
Plant / Prod. loss
>$1M
Environmental damage
>$1M
Fatality / Perm. Disab.
H
M
L
VL
VL
L
M
H
Probability of Event
VL
L
M
H
Probability of Event
Precautions taken to reduce the Precautions taken to reduce the Precautions taken to reduce the Precautions taken to
probability of a catastrophic
probability of a major incident
probability of a minor incident reduce the probability of
incident
occurring
occurring
a first aid or <$5K Plant
or Env. Loss incident
occurring
Assessor’s Name
Job Title
Signature
Date
Review Date