Risk – a poorly understood and often feared word. The ability to effectively and quickly assess risk is a critical skill that enables decision making both in and out of an operational environment. This article will define key risk related terms to allow the reader to build an understanding of how to manage risk in complex environments. It will define a new concept called multilateral risk and talk about the multi-dimensional impact of risk mitigation in a complex environment.
Key Terms:
- Multilateral – Many sided.
- Risk – The effect of uncertainty on objectives. It can be expressed positively as an opportunity or negatively as a threat.
- ALARP – As Low As Reasonably Practicable.
- SFARP – So Far As Reasonably Practicable.
- Reasonable – Not extreme or excessive, possessing sound judgement, in accordance with reason.
- Practicable – Capable of being put into practice or of being done or accomplished: feasible.
Warfare and Risk
Warfare is inherently risky. Tom McDermott correctly identifies that we must accept risk in order to be able to do our job. If we choose to accept no risk, we can no longer execute warfare. Therefore, we need to understand which risks to accept and how much is acceptable.
How Much Risk?
The terms ALARP or SFARP are used as perhaps the central guiding principles for risk assessment in both the ADF and commercially. While the differences between the two terms have been widely debated, rather than focus on the first three words, I believe the substance is in the definitions of the last two. Practicable has a very different meaning to the terms practical and possible. Couple this with the definition of reasonable and the requirement is clear. Making risk as low or as far as reasonably practicable means that the risk should be lowered only to the point where you can still effectively complete the task without excessive hindrance.
Grouping Risk by Type
Risk can be grouped in many ways. Army groups them into risk source categories (hostile elements, natural environment, organisational complexity, etc) and risk domains (mission, personnel, capability, reputation, etc). Other ways to group risk are:
Tolerability – acceptable (good risk that can be managed or exploited) versus unacceptable (bad risk that must be eliminated or reduced).
Timeframe – short term (has an immediate effect) versus long term (likely to impact in the future, or for longer duration).
We then assess the risk based on likelihood and consequence or degree of harm. Further, the same risk may be assessed in a different way dependent on the context and operating environment. Environment has perhaps the largest impact on the tolerability of a risk. This is why we assess this at the start of the Military Appreciation Process.
Multilateral Risk Concept
A new way to think about risk is to acknowledge that often risks pull in different directions. For instance, having people isolate during COVID-19 reduces the risk of transmission (short term); however, increases the risk of ongoing mental health concerns (long term). It is human nature to focus on the immediacy of the short-term risk, but we can’t discount the long-term risk. In this case, dependant on the context and operating environment at the time of assessment, COVID-19 transmission may have wider reaching implications. It is impossible to perfectly mitigate all risks within each risk domain – which results in a balancing act or ‘tug of war’.
Example 1: Supporting Hotel Quarantine on Operation COVID Assist
Background – a domestic operation within an exceptionally complex operating environment with multiple associated risks. Hotel quarantine operations had high media attention as the military was employed due to a previous issue with civilian contractors.
Complexity – weighing up the risk of mental health concerns from confining staff to hotel rooms outside of work times (personnel), the risk of COVID-19 transmission (personnel, mission, reputation), and the risk of adverse media attention (reputation).
Solution – disaggregation of work groups, scheduled meal timings in accommodation restaurant, use of accommodation gymnasium including an outdoor gym, and encouragement of group activities in working cells. As the risk of transmission increased, some comforts such as meals in a restaurant setting were traded for hot boxed meals for short periods of time.
Example 2: Operating a Distribution Centre in a COVID Environment
Background – as Australia began transitioning to living with COVID-19, the opening of state borders coupled with continuing COVID-19 isolation requirements caused intermittent disruptions throughout the national supply chain.
Complexity – Isolation requirements aimed at eliminating COVID-19 transmission had significant impact on supply chain, freight, logistics, and supermarket operations. Risk to food security outweighed the risk of COVID-19 transmission by close contacts.
Solution – state governments generated exemptions for ‘critically essential’ supply chain workers who were close contacts (among many other essential service staff) alongside changes in the definition of a close contact. Control measures were put in place to limit the risk accepted by ensuring only double vaccinated workers were exempt, rapid testing of close contacts was undertaken, and maintaining of isolation for COVID-19 positive workers.
A risk assessment is rarely one-dimensional. Every risk mitigation measure has the potential to impact another risk domain. In complex environments it is a balancing act that at times, may feel like a tug of war to keep risks at an acceptable level. You must understand how much risk exists, what you can do to reduce it, how much is acceptable and how much remains. This is the art of risk management and decision making.
The reference to ‘acceptance’ of risk is problematic. The comments to Tom McDermott’s recent article in Cove explain the rationale. In essence, whilst lowering the risk is a necessary objective, the focus should be on ensuring that risks are appropriately controlled so that risks are wither eliminated or minimised SFARP. The key question no matter whether the risk is combat-related or training-related is, “have I applied appropriate risk control measures to the identified risks?”.
We should be modest in our use of the word ‘tolerable’. Whilst tolerability has relevance to non-safety risks, it is questionable as to whether safety risks are tolerable (notwithstanding the existence of casualty rates for planning operations). A more appropriate term would be ‘retain’ so that the decision is to retain residual risk. Of course, the decision to retain any risk is based on the authorising officer’s level of risk management authority.
This might be an opportune time to pose a question. Are we focussing too much on risk and not enough on planning? The consideration of risk is a key component of planning but elevating risk above the mission is a defensive position. By shifting the focus to understanding the mission in the first instance, we will have, through the mission analysis process, identified, assessed, evaluated and developed risk control tasks to ensure the mission succeeds.
In the process of evaluating risk, we will also have assessed whether we will need more resources to control the identified risks or, we will have determined that the level of risk is beyond the level of authority designated to us by our senior leaders. In which case we would seek to elevate the decision making to a higher authority. This is the reason why every risk management framework should have a risk management authority so that risk decisions are made at the right level. The quality of the planning is enhanced when we assess risk in the perspective of the mission.
On the issue of grouping of risk, I agree with Robert in that risks can be grouped in a variety of ways. What practitioners should consider is the use of ‘Proximity’ where once risk control tasks have been applied, and the level of risk determined, proximity levels can be applied to each risk so that any grouping of Very High or High risks can be assessed as to when they are likely to occur. For example, Immediate, Close, Approaching, Distance, or Long Term. Needless to say, the shorter the proximity the higher the priority for resourcing the control measures.
With regard to the ‘Multilateral Risk Concept’, Robert’s comments regarding the ‘tug of war’ effect is quite valid. With regard to the topic of COVID-19, the bow-tie risk assessment methodology would neatly depict the conflict in control measures for both causes and consequences. An irony with the risk solution in Example 1 is that ancient Greek medical practitioners had a view on minimising the risk of contamination of infectious diseases – get plenty of fresh air; exercise; and eat fresh food.