Organisations have an obligation to identify risks and ensure that all the appropriate people in the organisation are made aware of them. Once identified, preventive measures can be taken and put in place to control the risks. What are the risks in your organisation?

In determining this consider:

• global risks that would or could impact your organisation and similar organisations
• risks within and outside your span of control
• risks associated with activities conducted outside your premises
• risks associated with outsourced or contracted services
• risks associated with the use by external organisations of your goods and services

How do you identify risk? There are many methods of risk identification. Whatever the method, ensure that it enables a comprehensive identification of risks, as unidentified risks cannot be planned for and treated. 'Brainstorm' potential risk exposures.

In considering approaches to identifying risks, consider using:

• personal experience or lessons from the past
• results of audits or physical inspections
• records of prior losses, (ie. claims, financial or property losses, data/record loss, lost time incidents/occupational health and safety reports)
• judgment – consensus, speculative/conjecture, intuition
• results of benchmarking for perceived performance deficiencies
• gap analysis – distinguishing between existing practice and business plan objectives

It is critical in the identification of risk, that two key elements of actual or potential exposure are identified, namely:

• the cause of an exposure (ie. failure of…, lack of..., loss of..., injury to....)
• the effect of the exposure - the effects may include financial impact, impact on staff, and other stakeholders, impact on reputation and probity, impact on operational management and impact on the delivery of programs

The most commonly used method of identification is an effective inspection program. An effective inspection program should detect most emerging risk issues.

Forms of inspection

An inspection program should be flexible. There are no hard and fast rules about this. It should be a combination of routine and non-routine inspection and includes:

1. routine inspection of all risks
2. routine inspection of a particular or area of risk
3. specific inspections resulting from recommendations, complaints, reports or advice from staff, users, stakeholders and others -This includes investigations and/or inspections recommended by the risk management or health and safety committee
4. inspections as a result of incidents or accidents

How often should inspections be undertaken?

Routine inspections should be carried out on a regular basis. The regularity depends on the nature of the risks and the circumstances affecting it. It could be monthly or quarterly. It should be more regular if circumstances warrant it. For example, if there is a high risk of injury through slips and falls, it is necessary to carry out more regular and diligent inspections to identify the causes of these slips and falls.

All risks that are reported even if you consider the source to be dubious should be treated seriously and inspected. Only then can you be confident about discounting them as possible risks.

What are you inspecting?

Make a list of all possible areas of risk including physical and non physical risks. There may be records of previous incidents and accidents logged in a database somewhere. Injury and incident reports are also valuable sources of information.

The following example relates to the inspection of physical risks:

1. To identify physical risks, you should obtain plans of the premises if you do not already have them
2. Keep the outdoor areas separate from the indoor
3. For a big facility, it is advisable to properly divide it into distinct and manageable portions
4. Prepare a standard checklist that can be used for the inspection. For example, you are interested in inspecting the following:

• physical condition of facilities
• lighting
• ventilation
• noise emission
• gas and electrical supply
• safety devices
• storage of goods especially dangerous goods like chemicals
• location and adequacy of first aid facilities
• emergency management procedures
• conformity with current standards and regulations

Everyone involved in the inspection process can then use this checklist to identify areas of risks that they are responsible for.

Who should conduct the inspection?

• Larger organisations would already have either a risk management and/or health and safety committee
• For smaller occupiers it may be the case of one person being the 'Jack of all trades'
• The committee should coordinate the process
• Inspections should be carried out by those responsible for the management of the different work areas from which the risk emanates
• The committee is then responsible for conducting regular audits to gauge the adequacy of the inspection programs
• In the event of specialist or expert advice being required, the assistance of relevant experts should be sought

How to conduct an inspection

• Procedures should be developed for all the different types of inspections
• These procedures should be made known to all relevant parties
• The inspection team should have properly clarified all procedures and developed a checklist before any inspection begins
• As a next step in the process, it is necessary to develop standard reporting documents that correspond with the checklist so that the results of inspections and remedial actions (both immediate and future) to be taken are properly documented
• Documentation is a key issue, as it would assist with any future audit or legal process
• The ability to provide documentary evidence is of paramount importance when defending a claim of negligence
• Any dangerous risks should be treated immediately

Categorising risk types

There are many sources of risk. The major challenge when analysing the risks to an organisation is finding a meaningful way to categorise them.

However, there is no definitive way to do this. Different people find some methods for categorising the sources of risk more useful or accessible than others. This may be related to experience, the industry that they operate in or it may be an organisational culture issue.

Standards Australia has developed a simple and effective tool (database) to support the AS/NZS4360:1999 Risk Management. Based on the framework of this standard, the database helps you identify, prioritise and capture treatment options for your organisation's risks. The database is an automated tool that culminates in the production of reports to support your risk planning process and can be downloaded from the Standards Australia website.

Here are some selected examples of the sources of risk, or risk categories, to provide direction on how terminology can be different without losing the conceptual understanding of how broad enterprise-wide risk management can be.

The Australian standard AS/NZS 4360:1999 Risk Management, identifies eight generic sources of risk:

1. Commercial and legal relationships
2. Economic circumstances
3. Human behaviour
4. Natural events
5. Political circumstances
6. Technology and technical issues
7. Management activities and controls
8. Individual activities

In addition, Australian Standards has provided a list of 13 categories, some of which may be sub-sets of the generic eight mentioned above, to give a more detailed example of risks that may apply to enterprise-wide risk in an organisation. These are:

The Department of Natural Resources & Environment, Victoria, uses the following 10 categories:

1. Asset management
2. Change management
3. Compliance
4. Environment
5. Financial
6. General management
7. Liability
8. Personnel
9. Service and product delivery
10. Technology

Arthur Andersen uses the three broad categories of environment, process and information for decision making risk with the following sub-categories:

Environment risk:

• competitor
• catastrophic loss
• sensitivity
• sovereign / political
• shareholder relations
• legal
• regulatory
• industry
• capital availability
• financial mark

Process risk

• operations risk
• empowerment risk
• information processing/technology risk
• integrity risk
• financial risk

Information for decision making risk

• operational
• financial
• strategic

There are many other models in the marketplace. A simple approach is to divide the sources of risks in one of the following terms and then identify sub-categories that pertain to their organisation:

1. Financial or non-financial
2. Insurable or non-insurable risk
3. Inherent or external risk
4. Systematic or non-systematic risk
5. Operational or non-operational risk

Each organisation may adopt different categories to suit their needs. However, a good check would be to compare your organisation's list against the Australian standard to ensure the range of potential risks is addressed.

The table below is an illustration of how you can match or align an organisation's individual or specific risk type against the categories presented in the Australian standard. To illustrate, CPA Australia has taken the Department of Natural Resources and Environment (DNRE) specific risk types and have adapted them to the Australian standard.

Categorising the sources of risk is one of the first steps to successfully completing a risk management exercise. The important thing is that whatever method is used, it should match the risk situation of your organisation and be agreed to by the organisation as meaningful and manageable.

Note: CPA Australia recommends that whatever categories are adopted, they should be measured and checked against AS/NZS4360:1999 categories for completeness.