Today the first episode of the Risk Expert Sessions with Prof. dr. Jop Groeneweg is published. In this session, the topic discussed is risk management in general. In our blog we further explain the contradictions that are brought forward in the interview.
Safety versus security
Risk management is part of both the safety as well as the security process, but requires a different approach. Prof. dr. Jop Groeneweg explains safety and security as exact opposites. Safety is about people with good intentions whilst security is about people with bad intentions, in both cases the end result is a bad situation. We can say that in safety we deal with unintentional harm and in security we deal with intentional harm.
Safety does not necessarily require different barriers from security, but each process does require a different approach. All barriers have a potential to fail, which we call the “holes” in barriers. From a safety perspective, people ensure the integrity of the barriers, while from a security perspective, people specifically look for the “holes” in barriers and have the intention to take advantage of them. The difference in barrier management is about the openness of the risk analysis. In safety, we want to know the performance of a barrier and if this performance is poor we want to improve it. However, from a security point of view, weaknesses of barriers are mostly not communicated to prevent people from taking advantage of these weaknesses. In both cases we deal with harm. Prof. dr. Jop Groeneweg is convinced safety and security can learn from each other’s weaknesses.
Process safety versus personal safety
When we dive deeper into the safety world, we see that the focus has changed over the years between process safety and personal safety. Organizations use to determine their safety status from a personal safety perspective, while process safety issues were almost ignored.
The blowout of Deep Water Horizon in 2010 changed this way of thinking and nowadays organizations also take process safety into account when determining their safety status. However, when we look at incidents, the causes for a personal safety incident and a process safety incident may be the same. So when we look at overall safety, it is more important to focus on the recognition of safety issues rather than focusing on the fundamental difference between process and personal safety.
Operational Excellence: The paper world versus the real world
The determination of the safety status of your organization is part of defining quality in operational excellence. However, operational excellence may be defined as good quality on paper but how does your organization perform in the real world?
This is a bottleneck for many organizations. We have the tendency to rely on information on paper, but in the real world this does not always corresponds with actual operations. The bowtie method helps organizations bring those two worlds together, by visualizing barriers and asking specific questions such as: is the barrier implemented or effective? This gives an overview of all the risks and controls your organization has in place. Furthermore, it can be used to communicate this information to the various layers in the organization. The bowtie visualizes the gaps between real world and paper world.
Future developments in risk management
Prof. dr. Jop Groeneweg sees some positive changes in safety approaches and mentions resilience as one of the better changes. In the video he explains it with a student-teacher example, where we may not be able to change student’s behavior, teachers try to adjust and change their own behavior. This situation works the same in the safety world. The fact that we accept we cannot change something, for example the number of incidents, allows us to “bounce back”, review the situation from another perspective. So instead of trying to decrease the number of incidents, you can focus on mitigating the consequences of these incidents.
There is one approach undervalued according to Prof. dr. Jop Groeneweg, which is looking at operations that go well instead of only looking at incidents. He refers to Walter A. Shewhart with his statistical process control. We should look at our normal operation and try to reduce the variation from normal operations as much as possible.
In our opinion the first episode of these risk expert sessions ends with a valuable advice: “Don’t worry only about what goes wrong, but be worried about the variation in the behavior that you see”.
Risk Expert Sessions: Episode 1 – Risk management in general
Interested to see the full video and find out more about what Prof. dr. Jop Groeneweg has to share with reference to risk management in general? Click here to watch this episode of the Risk Expert Sessions.