BSBRSK501

Manage risk
Learner Guide
 Page |1

Table of Contents

Unit of Competency...............................................................................................................................5
Application..........................................................................................................................................5
Performance Criteria...........................................................................................................................6
Foundation Skills.................................................................................................................................7
Assessment Requirements..................................................................................................................8
1. Establish risk context.........................................................................................................................9
1.1 – Review organisational processes, procedures and requirements for undertaking risk
management in accordance with current risk management standards................................................10
Reviewing your workplace processes to manage risk.......................................................................10
Organisational policy and procedures...............................................................................................11
Risk management in your working processes...................................................................................11
Activity 1A.........................................................................................................................................12
1.2 – Determine scope for risk management process...........................................................................13
Determining the nature and scope of workplace hazards.................................................................13
Sources of risk and hazard information.............................................................................................13
Legislative and regulatory context....................................................................................................14
Risk management for work health and safety (WHS)........................................................................14
Other legislation that may be applicable..........................................................................................16
Activity 1B.........................................................................................................................................20
1.3 – Identify internal and external stakeholders and their issues........................................................21
Your stakeholders.............................................................................................................................21
Identifying relevant stakeholder issues.............................................................................................21
Activity 1C.........................................................................................................................................23
1.4 – Review political, economic, social, legal, technological and policy context..................................24
Context of risk...................................................................................................................................24
Organisation influences.....................................................................................................................25
Activity 1D.........................................................................................................................................26
1.5 – Review strengths and weaknesses of existing arrangements.......................................................27
Strengths and weaknesses of your business operations...................................................................27
Look at your existing risk management.............................................................................................29
Activity 1E.........................................................................................................................................30
 Page |2

1.6 – Document critical success factors, goals or objectives for area included in scope.......................31
Report on risk management..............................................................................................................31
Critical success factors......................................................................................................................31
Activity 1F..........................................................................................................................................32
1.7 – Obtain support for risk management activities............................................................................33
1.8 – Communicate with relevant parties about the risk management process and invite participation
..............................................................................................................................................................33
Seek organisational support..............................................................................................................33
External stakeholder support............................................................................................................33
Work with your stakeholders............................................................................................................33
A process of communication.............................................................................................................34
Activity 1G.........................................................................................................................................36
2. Identify risks....................................................................................................................................37
2.1 – Invite relevant parties to assist in the identification of risks........................................................38
Identifying risks with the help of others............................................................................................38
Interacting with stakeholders...........................................................................................................38
Communication conventions............................................................................................................39
Activity 2A.........................................................................................................................................40
2.2 – Research risks that may apply to scope........................................................................................41
Researching risks...............................................................................................................................41
Tools for performing research...........................................................................................................42
Activity 2B.........................................................................................................................................43
2.3 – Use tools and techniques to generate a list of risks that apply to the scope, in consultation with
relevant parties.....................................................................................................................................44
Tools to identify risks........................................................................................................................44
Risk management strategies.............................................................................................................46
Activity 2C.........................................................................................................................................47
3. Analyse risks....................................................................................................................................48
3.1 – Assess likelihood of risks occurring..............................................................................................49
3.2 – Assess impact or consequence if risks occur................................................................................49
Assess and analyse your risk factors.................................................................................................49
Risk categorisation............................................................................................................................50
Risk matrix.........................................................................................................................................51
The level of risks................................................................................................................................52
 Page |3

Activity 3A.........................................................................................................................................53
3.3 – Evaluate and prioritise risks for treatment...................................................................................54
Prioritise the risks..............................................................................................................................54
Hierarchy of risk controls..................................................................................................................54
Contingency planning........................................................................................................................55
Activity 3B.........................................................................................................................................56
4. Select and implement treatments....................................................................................................57
4.1 – Determine and select most appropriate options for treating risks..............................................58
Strategies for controlling risk............................................................................................................58
Sequence risk control activities.........................................................................................................58
Treatment options............................................................................................................................59
Porter’s Five Forces...........................................................................................................................60
Activity 4A.........................................................................................................................................61
4.2 – Develop an action plan for implementing risk treatment.............................................................62
Measures you can take.....................................................................................................................62
Developing a plan to treat the risks..................................................................................................62
Activity 4B.........................................................................................................................................66
4.3 – Communicate risk management processes to relevant parties....................................................67
Communicate your risk management processes..............................................................................67
Verbal communication......................................................................................................................67
Non-verbal communications.............................................................................................................69
Activity 4C.........................................................................................................................................70
4.4 – Ensure all documentation is in order and appropriately stored...................................................71
Documentation.................................................................................................................................71
Documenting the results of risk assessments...................................................................................71
Activity 4D.........................................................................................................................................73
4.5 – Implement and monitor action plan.............................................................................................74
Implementing treatment plans.........................................................................................................74
Operational risks...............................................................................................................................75
Implementing a risk control plan......................................................................................................75
Activity 4E.........................................................................................................................................76
4.6 – Evaluate risk management process..............................................................................................77
Monitoring risk..................................................................................................................................77
Evaluating implemented risk controls...............................................................................................78
 Page |4

Activity 4F..........................................................................................................................................79
Summative Assessments.......................................................................................................................80
References............................................................................................................................................81
 Page |5

Unit of Competency
Application

This unit describes skills and knowledge required to manage risks in a range of contexts across an
organisation or for a specific business unit or area in any industry setting.

It applies to individuals who are working in positions of authority and are approved to implement
change across the organisation, business unit, program or project area. They may or may not have
responsibility for directly supervising others.

No licensing, legislative or certification requirements apply to this unit at the time of publication.

Unit Sector

Regulation, Licensing and Risk – Risk Management

 Page |6

Performance Criteria
Element Performance Criteria
Elements describe the Performance criteria describe the performance needed to
essential outcomes. demonstrate achievement of the element.

1. Establish risk context 1.1 Review organisational processes, procedures and

requirements for undertaking risk management in
accordance with current risk management standards
1.2 Determine scope for risk management process
1.3 Identify internal and external stakeholders and their issues
1.4 Review political, economic, social, legal, technological and
policy context
1.5 Review strengths and weaknesses of existing arrangements
1.6 Document critical success factors, goals or objectives for
area included in scope
1.7 Obtain support for risk management activities
1.8 Communicate with relevant parties about the risk
management process and invite participation

2. Identify risks 2.1 Invite relevant parties to assist in the identification of risks
2.2 Research risks that may apply to scope
2.3 Use tools and techniques to generate a list of risks that apply
to the scope, in consultation with relevant parties

3. Analyse risks 3.1 Assess likelihood of risks occurring

3.2 Assess impact or consequence if risks occur
3.3 Evaluate and prioritise risks for treatment

4. Select and implement 4.1 Determine and select most appropriate options for treating
treatments risks
4.2 Develop an action plan for implementing risk treatment
4.3 Communicate risk management processes to relevant
parties
4.4 Ensure all documentation is in order and appropriately
stored
4.5 Implement and monitor action plan
4.6 Evaluate risk management process
 Page |7

Foundation Skills
This section describes language, literacy, numeracy and employment skills incorporated in the
performance criteria that are required for competent performance.

Skill Performance Description

Criteria

Reading 1.1, 1.4, 1.5, 2.2  Comprehends a variety of relatively complex texts
 Gathers, interprets and analyses textual
information from a range of sources to identify
relevant information

Writing 1.6, 1.8, 2.1, 2.3, 4.3  Develops textual material and organises content
in a manner that effectively documents risk
management analysis and assessment priorities
and processes

Oral 1.8, 2.1, 2.3, 4.3  Participates in interactions with stakeholders

communication using questioning and listening to elicit opinions,
and to confirm and clarify understanding

Numeracy 2.2  Uses numerical tools to assess risk and uses

numerical data to review plans

Navigate the 1.1, 2.1, 4.3  Refers to organisational processes, procedures

world of work and requirements when making decisions about
risk management

Interact with 1.8, 2.1, 2.3, 4.3  Establishes and uses appropriate conventions and
others protocols when communicating with stakeholders
about risk management
 Consults and negotiates with stakeholders about
risk management processes and outcomes

Get the work 1.2, 1.3, 1.5, 1.7, 2.1, 2.2, 2.3,  Sequences and schedules a range of routine and
done 3.1, 3.2, 3.3, 4.1, 4.2, 4.4, 4.5, complex activities, monitors implementation,
4.6 evaluates processes and manages relevant
communication
 Systematically analyses information to decide on
appropriate risk management treatments
 Uses digital technologies and systems to access
information, document plans and communicate
with others
 Page |8

Assessment Requirements
Performance Evidence

Evidence of the ability to:

 Analyse information from a range of sources to identify the scope and context of the risk
management process including:
o stakeholder analysis
o political, economic, social, legal, technological and policy context
o current arrangements
o objectives and critical success factors for the area included in scope
o risks that may apply to scope
 Consult and communicate with relevant stakeholders to identify and assess risks, determine
appropriate risk treatment actions and priorities and explain the risk management processes
 Develop and implement an action plan to treat risks
 Monitor and evaluate the action plan and risk management process
 Maintain documentation

Note: If a specific volume or frequency is not stated, then evidence must be provided at least once.

Knowledge Evidence

To complete the unit requirements safely and effectively, the individual must:

 Outline the purpose and key elements of current risk management standards
 Outline the legislative and regulatory context of the organisation in relation to risk management
 Outline organisational policies, procedures and processes for risk management

Assessment Conditions

Assessment must be conducted in a safe environment where evidence gathered demonstrates

consistent performance of typical activities experienced in the regulation, licensing and risk - risk
management field of work and include access to:

 Relevant legislation, regulations, standards and codes

 Relevant workplace documentation and resources
 Case studies and, where possible, real situations
 Interaction with others

Assessors must satisfy NVR/AQTF assessor requirements.

Links

Companion volumes available from the IBSA website: http://www.ibsa.org.au/companion_volumes -

https://vetnet.education.gov.au/Pages/TrainingDocs.aspx?q=11ef6853-ceed-4ba7-9d87-4da407e23c10
 Page |9

1. Establish risk context

1.1. Review organisational processes, procedures and requirements for undertaking risk
management in accordance with current risk management standards

1.2. Determine scope for risk management process

1.3. Identify internal and external stakeholders and their issues

1.4. Review political, economic, social, legal, technological and policy context

1.5. Review strengths and weaknesses of existing arrangements

1.6. Document critical success factors, goals or objectives for area included in scope

1.7. Obtain support for risk management activities

1.8. Communicate with relevant parties about the risk management process and invite participation
 P a g e | 10

1.1 – Review organisational processes, procedures and requirements for

undertaking risk management in accordance with current risk management
standards
By the end of this chapter, the learner should be able to:
 Assess the different situations of workplace risk

 Understand the importance of workplace policy for managing risk

 Be able to look at working processes when seeking to manage risk.

Reviewing your workplace processes to manage risk

When seeking to manage risk in the workplace, you will first need to understand the current situation of
risk and how this is being addressed throughout the workplace. This will include all aspects of the
business and can affect both your internal and external stakeholders.

Risk management in business is also known as:

 Enterprise risk management (ERM)

 Business risk management (BRM).

Risk can apply to both your organisation’s business

activities and to the immediate environmental factors
within the workplace.

Managing risk includes looking at the

following areas:
 Work health and safety

 Operations

 Finances

 Environmental and sustainability factors

 Reporting

 Compliance

 Governance.

For example, within your business activities you will need to check whether organisational processes
support business needs and whether money is being wasted unnecessarily within organisational
spending. In aspects of work health and safety, risks need to be eliminated or minimised to safe levels,
(e.g. if chemicals are used, how these should be stored and used).

You should assess the current level of risk management in place and determine if this is meeting all the
needs of your organisation’s business.
 P a g e | 11

Organisational policy and procedures

Organisational policy provides a description of the legal and ethical requirements that must be followed
in business; it can also include the values, philosophy and codes of conduct that the organisation
believes in and uses. Each policy statement will need to have an accompanying procedure to fulfil the
policy requirements. This provides all employees with structured processes and actions.

As such, you will need to review organisational policy and procedures to check that this meets
organisational requirements to manage workplace risks.

You should also check your specific policy on managing risk; this may also be identified in work health
and safety/occupational health and safety policy.

Risk management policies and procedures

Policy to manage risks should cover your business and work needs; all situations and scenarios should
be considered so that risk management can be applied across all areas.

Risk management policy and procedures includes:

 Identification of risks and hazards

 Assessment of risks and hazards (categorising risks for the likelihood of occurrence and
the consequence of this)

 Risk measures and controls

 A process of monitoring and reviewing risk controls.

Risk management in your working processes

You should pay attention to how effective your organisation’s business activities are being carried out.
Check your current standards and how other managers and employees conduct business, with a view to
ensuring adequate controls are in place to counteract the potential risks within your organisation’s
work.

For example, risks in work activities may include:

 How money is handled, e.g. are budgets being maintained?

 How resources are used, e.g. is equipment/machinery

being looked after (is your organisation using
sustainable practices)?

 How your business relationships are conducted, e.g. are

working relationships successful and well-established?

 How customers/clients are managed, e.g. do you

provide good customer service practices/are you
retaining or attracting new business?
P a g e | 12

Activity 1A
 P a g e | 13

1.2 – Determine scope for risk management process

By the end of this chapter, the learner should be able to:
 Understand the necessity to determine the scope for risk management

 Assess legislative and regulatory requirements for your areas of risk

 Know the value of standards in business.

Determining the nature and scope of workplace hazards

Determining the nature and scope of workplace hazards is vital if you are to successfully minimise the
number (and the impact) of hazards at work. Taking the time to assess each area of risk and the possible
hazards will not only enable you to more effectively prevent unwanted incidents, but also to develop a
contingency plan for whenever incidents do occur.

To determine the nature and scope of workplace hazards, ask yourself questions such as:
 Which area of business needs to be addressed?

 What types of hazards exist there?

 What are the individual hazards and where do they originate from?

 How many times, on average, do specific incidents occur as a result of the hazard each
month or year?

 When, and in what circumstances, do these

incidents tend to occur?

 Who is most likely to be affected?

 What kind of a risk to individuals does the

hazard pose?

o For example, risk of injury or loss of

reputation or business.

Your key elements for risk management

Determine your priorities and key needs for managing risk. For example, if you work within the financial
industry, you will need to look at the key financial risk areas when conducting business. If you work
within hospitality your key areas may include health and hygiene in handling food, security of
employees and customers, and sustainable work practices. Each business industry will have its own
priorities alongside the core areas of risk such as work health and safety.

Sources of risk and hazard information

In order to identify hazards and assess and control risks, it helps to have a strong understanding of the
various work issues that apply – or could apply. This means identifying and consulting a range of sources
of information and data on hazards and risks.
 P a g e | 14

Sources of information and data on hazards and risks include:

 Colleagues, managers/supervisors and employees

 Organisational policies and procedures

 Codes of conduct

 Work health and safety (WHS) legislation

 Industry regulations

 Federal and state government regulations

 Incident and hazard logbooks

 In-house statistics and data

 Anecdotal evidence

 Training days, workshops, seminars, conferences and other events

 Newspapers, magazines, journals.

Once you have identified a wide range of sources of information and data on hazards, you then need to
obtain this information and analyse it to determine the nature and scope of workplace hazards, the
range of harms they may cause and how these harms are caused.

Legislative and regulatory context

Risk management in work activities will also come under relevant business industry legislation and
regulation, depending on your particular industry of business.

For instance, your organisation may need to obtain specific licences or permits for conducting business
activities, for example if working in the transport industry, licences to ship certain goods may be
required. Ensuring your organisation is fully compliant in business will prevent unnecessary risks in
carrying out your business activities.

Risk management for work health and safety (WHS)

The specifics and features of your WHS policies will vary according
to the nature and scope of work your organisation does. But there
are certain issues which should always be covered, regardless of
your industry.
 P a g e | 15

WHS policies and procedures should cover:

 The organisation’s commitment to establishing a safe and healthy workplace

 The full range of hazards and risks associated with each job and workplace location

 An awareness of relevant industry guidelines, regulations and relevant legislation

 The procedures to be followed for each specific area of work

 The WHS responsibilities of each employee (according to their position)

 The importance of communication and cooperation between all employees

 The organisation’s commitment to regular reviews of policies and procedures.

For example, a workplace policy could be to ‘minimise work health and safety hazards’, while the
procedures that underpin this policy could include ‘clearing up all spills immediately,’ and ‘washing
hands after exposure to chemicals’.

WHS policies and procedures play a huge role in protecting the health and safety of employees. They
serve to remind employees of safe behaviour and help minimise hazards and reduce risks.

Work Health and Safety (WHS)/Occupational Health and Safety (OHS) legislation
Under relevant state/territory (and harmonised Commonwealth) work health and safety laws, all
persons in the workplace will have a duty to comply with health and safety requirements.

A worker under Section 28 of the WHS Act must:

 Take reasonable care of their health and safety

 Take reasonable care of the health and safety of the people

around them

 Comply with their employer’s instructions.

An employer under Section 19 of the WHS Act is required to

provide:
 Processes to ensure that the health and safety of
persons is not put at risk by maintaining:

o a safe work environment

o maintenance of all equipment, personal protective equipment (PPE) and

chemicals as required by law

o up-to-date information, training and instruction to ensure that all persons are
protected from risk.

Persons conducting a business or undertaking (PCBUs)

 P a g e | 16

PCBUs have a legal duty to ensure that health and safety are maintained at their workplace and should
ensure that duties to carry out the safety of the workforce are performed. A PCBU is the legal
individual(s) or organisation that operates the business.

A PCBU can be someone that:

 Employs workers to carry out work for them

 Directs work that is performed by workers

 May put others at risk from their business or undertaking

 Manages, or is in charge of, the workplace and facilities.

Other legislation that may be applicable

You may need to consider the following areas of legislation and industry standards, within your working
practices, for managing the different kinds of risk.

Considerations may include:

 Consumer and competition laws for fair trading practices

 Product liability regulations

 Food safety standards

 Work health and safety legislation.

Anti-discrimination
Anti-discrimination protects against discriminatory behaviour in and out of the workplace; it prevents
you from non-compliance with employees and customers/clients.

Anti-discrimination legislation includes:

 Age Discrimination Act 2004

 Australian Human Rights Commission Act 1986

 Disability Discrimination Act 1992

 Racial Discrimination Act 1975

 Sex Discrimination Act 1984.

You must follow these laws in all aspects of your work. You cannot discriminate against individuals
based on characteristics like age, gender, disability and race and you
must afford everyone equal opportunities. Full details about these Acts
can be found at https://www.humanrights.gov.au/our-
work/legal/legislation (access date: 27.09.2016).

Privacy of information
 P a g e | 17

The main aspect of confidentiality requirements is The Privacy Act. This is an Australian law that came
into force in 1988 and governs how organisations handle personal information about people, whether
staff, clients or customers, etc.
 P a g e | 18

The Privacy Act comprises of 13 privacy principles which are:

 Open and transparent management of personal information

 Anonymity and pseudonymity

 Collection of solicited personal information

 Dealing with unsolicited personal information

 Notification of the collection of personal information

 Use or disclosure of personal information

 Direct marketing

 Cross-border disclosure of personal information

 Adoption, use or disclosure of government related identifiers

 Quality of personal information

 Security of personal information

 Access to personal information

 Correction of personal information.

Further information on the privacy principles and the Privacy Act can be found at the Office of the
Australian Information Commissioner (OAIC) website: https://www.oaic.gov.au/individuals/privacy-fact-
sheets/general/privacy-fact-sheet-17-australian-privacy-principles and
https://www.oaic.gov.au/privacy-law/privacy-act/ (access date: 27.09.2016).

Environmental issues
Minimising negative impact to the environment and running a sustainable business operation can help
manage risks within your organisation. Guidance and compliance on elements such as
importing/exporting goods, managing hazardous waste and maintaining our culture and heritage exists.
Environmental legislation will also let you know whether your particular business activities require a
licence or permit.
 P a g e | 19

Environmental legislation includes:

 Environment Protection and Biodiversity Conservation (EPBC) Act (Federal)

 Environmental Protection Act 1997 (Australian Capital Territory)

 Protection of the Environment Operations Act 1997 (New South Wales)

 Environmental Assessment Act 1982 (Northern Territory)

 Environmental Protection Act 1994

(Queensland)

 Environment Protection Act 1993 (South

Australia)

 Environmental Management and Pollution

Control Act 1994 (Tasmania)

 Environment Protection Act 1970 (Victoria)

 Environment Protection Act 1986 (Western

Australia).

Further information on environmental compliance in business can be found at the following

Government website: https://www.business.gov.au/Info/Run/Environmental-
management/Environmental-legislation (access date: 27.09.2016).

ISO 14000 is the international standard for environmental management, for businesses. This is a family
of standards that covers a range of environmental concerns.

ISO 14000 standards include:

 Environmental performance evaluation

 Labelling and declarations

 Life-cycle assessment

 Water and carbon footprints.

International risk management standards

ISO 31000 is the international standard for risk management and helps organisations in their risk
analysis and assessment.

This applies to business activities such as:

 Planning

 Management operations

 Communications.
 P a g e | 20

By following ISO 31000, organisations can look to improve their business operations, governance and
increase stakeholder confidence through minimising losses. It also focuses on health and safety in the
workplace, provides tools to help in decision-making for pro-active management. Organisations can look
to improve their compliance with relevant legislation and become better equipped to identify the
potential threats and also the opportunities.

Further information on ISO 31000 can be found at the ISO website:

http://www.iso.org/iso/home/standards/iso31000.htm (access date: 27.09.2016).
P a g e | 21

Activity 1B
 P a g e | 22

1.3 – Identify internal and external stakeholders and their issues

By the end of this chapter, the learner should be able to:
 Recognise stakeholder groups

 Understand different stakeholder issues.

Your stakeholders
Stakeholders refer to any individual, group or organisation that has an interest in an organisation’s
business. This interest stems from the fact that decisions made within that business will have an impact
directly upon them. The level of impact will depend upon the association with that business.

Stakeholders relevant to your risk management include:

 Your organisation’s employees

 Organisational management

 The business owner/person

conducting a business or
undertaking (PCBU)

 Contractors

 Volunteers

 Customers/clients

 Service providers and

suppliers

 Unions

 Regulatory associations and peak bodies

 Health and safety representatives (HSRs) or a health and safety committee (HSC).

Identifying relevant stakeholder issues

Each type of stakeholder will have their own perspective on risks and these should be incorporated into
your overall risk management. To truly understand their concerns, you should consult with your
stakeholders. This may be in the form of an official workplace consultation on health and safety
practices or a work review, or you may hold separate discussions and consultations with specific
stakeholder groups to gain opinions and understanding.

If consulting with your customers or clients, you may want to provide a questionnaire or feedback form
to obtain their comments. The form of communication or consultation should be appropriate to the
stakeholder group; this can be formal or informal in approach.
 P a g e | 23

Consultations with stakeholders should be performed in-line with legal requirements and as courtesy to
those who have an interest in your business. It allows you to inform them of any potential major
changes with your business and enables you to record their thoughts and feedback. This provides
evidence of other viewpoints which should be documented clearly and thoroughly.

Stakeholder risk concerns may include:

 Unregulated working hours, causing worker
fatigue

 Poor customer service levels and feedback

 Work area ergonomics

 Supplier delivery issues

 Changes to business legislation

 Financial stability/available equity.

Meeting with stakeholders may require detailed reporting and

minute-taking so that a record can be made of the meeting and its
outcomes. This may be needed to provide information to your
stakeholders when communicating any changes to business.
P a g e | 24

Activity 1C
 P a g e | 25

1.4 – Review political, economic, social, legal, technological and policy context
By the end of this chapter, the learner should be able to:
 Determine different contexts for risk

 Look at organisational and societal contexts.

Context of risk
Looking at the context of risk will help you to recognise the
type of risks and the likelihood of their occurrence. This can
be particular to your organisation, such as risk for a specific
project or for new workplace premises, or it can be related
to broader issues.

Context is determining the circumstances that are

applicable to the situation of risk, i.e. the factors that
surround and influence it.

Risk context includes:

 Political – this can relate to the politics of the organisation and how business is
conducted, or this could include the current political climate within your
state/territory, or Australia as a whole. Internal organisational politics will be
concerned with how the business is structured and how it is run, e.g. the preferences in
work approaches, management styles and philosophy. Australian or world politics may
have an influence on your business, e.g. current political agendas, trade laws and
business funding.

 Economic – this is about the business climate and how well your organisation or
business industry is fairing in the current economic market. Influences on economy
include politics and how customers/clients decide to spend their money, and world
events such as conflicts and acts of terrorism. A shift in economy can cause a boost or
decline in your profits or demand for business.

 Social – this can refer to the collective within your organisation (how employees are
working, their working relationships and morale), it can also include the wider
community or your customer/client-base. Your employees’ attitudes and practices can
influence work activities positively or negatively, being aware of the social setting can
help you to deter situations of risk or decide on control measures. The social attitudes
of your community can have a bearing on how well your business performs, e.g. if your
organisation is well-thought of, or whether you work positively with the community.

 Legal – this concerns the legal and regulatory needs that your organisation must follow
and the risks that can be incurred as a result of non-compliance. Risks associated with
legal business can be easily identified and rectified. This context should provide you
with a clear means to resolve a situation of risk.
 P a g e | 26

 Technological – this is about how your organisation uses and responds to technology.
Risks can include out-dated equipment, old technologies or even a lack of embracing
current technologies in the workplace. With continual technological advances, it is not
always easy to evolve working practices as fast as technology moves. Organisations
investing in new machinery or equipment will need to ensure its longevity within
organisational work plans.

 Policy-based – a look at the internal structure and workings of the organisation and
whether policy truly captures the potential areas of risk. Identifying issues with
organisational policy (and/or procedures) will require a review of current policy. Policy
influences may also be felt through Government/local government business activities
and associated trade or industry regulatory bodies/associations.

 Health and safety – this will concern the organisation’s practices to support the health
and well-being of employees and visitors to the workplace. This can include safe
premises, safe working methods and systems, ergonomic work areas, safe equipment
and machinery and emergency procedures.

It is important to review the context of your risk to make sure you assess and tackle the underlying
influences and causes.

Organisation influences
The way that your organisation functions will influence how circumstances
and contexts impact on business. Knowing how your organisation performs
its day-to-day requirements will help to better assess how other factors will
affect it.

For example, if a change in legislation puts one of your business activities at

risk of health and safety, the speed of response from within your
organisation may be fast, with little or no impact felt. Alternatively, your
organisation may need to review its practices or budgets to find compliant
methods to maintain health and safety, which could take time. The
structure and governance of your organisation can determine how issues of
risk are felt within work practices and how they are ultimately dealt with.
P a g e | 27

Activity 1D
 P a g e | 28

1.5 – Review strengths and weaknesses of existing arrangements

By the end of this chapter, the learner should be able to:
 Assess strengths and weaknesses in organisational operations

 Perform a S.W.O.T. analysis

 Determine current risk measures in place.

Strengths and weaknesses of your business operations

As part of your risk management, you will need to assess the capabilities of your organisation and
whether you have the resources and the level of experience required. Make an open assessment and
look at the strengths and weaknesses of your current business arrangements.

Strengths may include:

 Experienced personnel with excellent training

 Good resources available

 Thorough analysis of risk management

 Backing from your insurance agents/financial managers.

Weaknesses may include:

 Lack of overall project management

 Unassigned roles of responsibility with risk

management

 Poor resources available

 Limited budget.

S.W.O.T analysis
A strengths, weaknesses, opportunities and threats (S.W.O.T.) analysis can be used to evaluate
measures in place for addressing potential risks. Strengths and weaknesses usually refer to the internal
factors within your organisation – these are the elements that need to be assessed and controlled
before looking at the possible opportunities or threats.

Opportunities and threats are the factors that you will come against – to optimise your opportunities
and to eliminate/minimise the threats; you need to plan your tasks accordingly. These are mostly
external factors that influence a situation, although this can be anything external to the management of
the business (e.g. employee opportunities or threats).

This can be a useful tool to keep you on track and to help you readjust any strategies or to redirect your
objectives along the way.
 P a g e | 29

Example S.W.O.T. analysis table:

Strengths Weaknesses

 Budgets approved for new resources  Time will be needed to gain all the resources
 Employee skillsets varied  Costs may increase
 Loyal customer-base  Training to use new technologies will be
needed

Opportunities Threats

 Better equipment and tools to carry out work  Consumer market close to saturation
 New resources for new business  Longevity of outcome unsure
 Possible expansion of organisation  Delays in meeting deadlines

Gather all the information that you need to start making decisions on the next steps. Without all the
information at hand, making decisions will be difficult and could prove to be incorrect for your
organisation’s needs. Never assume anything, find the information that you need and make sure it is
from trusted and approved sources.

The following highlights some of the steps you may need to take when looking to make
decisions:
 Identify the issues and determine initial risks

 Analyse the situation to understand what information you have, what you will need
and how you can get this

 Use a S.W.O.T. analysis to determine if further investigations are plausible

 Identify all scenarios and options available (brainstorm with colleagues and anyone else
who can help)

 Select the best option and develop a risk analysis and contingency plan

 Implement the decision and document the steps taken to get to this point.

P.E.S.T. analysis
Alongside a S.W.O.T. analysis, you may find a P.E.S.T. analysis useful to do. This is a political, economic,
social and technological analysis and can be used to target specific areas and influences to the business.
This is best done prior to a S.W.O.T. analysis as it can help you to target your S.W.O.T. analysis on
specifics.

A P.E.S.T. analysis should have a clear focus on the position for the analysis. For example, it can be the
organisation looking at its market/customers, an opportunity to make an investment or when making an
acquisition. P.E.S.T. looks at the bigger decision-making activities, while S.W.O.T. addresses the factors
that impact at a working level.
 P a g e | 30

P.E.S.T. analysis questions can include:

 Political – are state/territory or national elections taking place and could this impact
your direction?

 Economic – is the country’s economy at a stable point for making your decision?

 Social – is a generational shift going to impact on your outcomes?

 Technological – will changes in technology have a bearing on current actions?

Look at your existing risk management

Your current controls may be as effective as you require them to be, but you should always check your
controls on a regular basis to ensure they are, and remain, appropriate at managing your organisation’s
business needs.

Questions to ask regarding your existing risk controls can include:

 What measures are in place to minimise this risk?

 What is the reasoning behind establishing these measures?

 How effective are these measures?

 Which individuals are protected by these measures?

 Which individuals are not protected by these measures?

 Can we do more to minimise the risk?

 P a g e | 31

Activity 1E
 P a g e | 32

1.6 – Document critical success factors, goals or objectives for area included in
scope
By the end of this chapter, the learner should be able to:
 Know the necessity for documenting requirements

 Understand the relevancy of a critical success factor.

Report on risk management

Ensure you document all your findings and investigations into risk management needs. Records need to
be kept and maintained for different reasons.

Records are kept for:

 Documenting work activities

 Evidence of research, investigations and outcomes

 Logging progress and completion of work

 Gaining statistics for assessing and analysing information

 Legal reporting requirements.

For your risk area, gather the documentation you have gained and assess the information for its worth
and relevancy in determining the critical success factors. The critical success factors will enable you to
focus on achieving your organisational goals and objectives. This will maintain your focus when
assessing the matter further and looking to implement suitable controls.

Critical success factors

The term critical success factor (CSF) in business describes a
requirement that is recognised as being essential for
achieving success. Critical success factors are closely aligned
to organisational objectives and goals. These are the actions
that enable goals to be reached, for example, acquiring new
computer technology in order to manage a new customer
database (CRM – customer relationship management
software) is a CSF. This action can assist an organisation to
attain their goal to improve their business relationships.

As mentioned above, goals and objectives are the elements

that need to be achieved for the organisation to consider
itself successful.
 P a g e | 33

Activity 1F
 P a g e | 34

1.7 – Obtain support for risk management activities

1.8 – Communicate with relevant parties about the risk management process
and invite participation
By the end of this chapter, the learner should be able to:
 Recognise the value in obtaining support for risk management activities

 Assess communication methods for inviting participation

 Formulate a risk management process.

Seek organisational support

Support for carrying out your risk management activities will
primarily come from your internal stakeholders. Managers and
supervisors will need to be involved in your actions to perform
risk management; they will help implement the recognised
measures and controls at a higher level. They can provide
guidance and encouragement to work teams and employees in
every-day work tasks.

Employees can also help support risk management by complying

with, and carrying out, the identified measures and controls.

To gain support from management and employees, you will also

need to give support. This will be in the form of providing clear and thorough information and viable
work practices and methods for risk management at work. You may also need to ensure employees
have the correct knowledge and skills training to enable them to manage workplace risks to risk
management plans.

External stakeholder support

You may also need to gain the support of some of your external stakeholders; this may include your
suppliers, contractors and volunteers. These will be the people who work closely with you; for example,
you may need to request a different work process with your suppliers, in order to minimise workplace
risk, which may include using new documentation or forms for placing and receiving orders.

Contractors and volunteers that work within (or for) your organisation will also need to be informed on
new risk-related practices and be provided with additional instruction or training to carry these out.

Work with your stakeholders

Gaining support from relevant stakeholders will require you to take the lead and be clear on the type of
support that is needed. You should take a direct approach, provide all relevant information and assist in
the set-up of any requirements. This may include producing workplace guidance documentation.
 P a g e | 35

Risk management activities may include:

 Carrying out regular workplace safety checks

 Logging information

 New working practices and procedures

 Communication processes.

Showing your support will be of value in achieving stakeholder participation. You need to treat others
with respect and courtesy, do not presume all stakeholders will necessarily see the immediate benefits
of your risk management activities. Take time to explain changes and provide a means to engage in
open communications to assist in any transitions and to gain stakeholder understanding.

You can:
 Place value on your workplace practices

 Provide training and instruction on procedural changes

 Share information on the organisation’s objectives and risks management needs

 Trust stakeholders, and delegate roles and responsibilities to manage risks.

A process of communication
To include the relevant parties in the risk management process you will need to let them know that
their input is welcomed or required. Communications will need to take place to provide this information
and to invite participation.

Communications may take the form of:

 Consultations

 Workplace meetings

 Individual and group discussions

 Telephone conversations

 Written information and letters

 Electronic communications, such as email

 Website/intranet communications.

Participation may be compulsory (e.g. organisational employees)

or at request (e.g. a supplier input into improving ordering processes). Ensure that you receive
confirmation of participation so that you know stakeholders are in receipt of the communication. This
will allow you to also confirm understanding of the situation and in the level of involvement.
 P a g e | 36

Risk management process

The process to manage risks will include a step-by-step procedure; this will show a logical application to
recognise and control risks. Situations of risk will differ but a process to manage these will operate in the
same way; this serves to provide a straightforward application.

A risk management process will include:

 Identifying risks involved

 Analysing risks and assessing their impact

 Evaluating how these will affect the organisation

 Rating the risks to determine the control measures

 Treating the risks to either eliminate or control them to safe levels

 Monitoring and reviewing risk management activities on a regular basis.

P a g e | 37

Activity 1G
 P a g e | 38

2. Identify risks
2.1. Invite relevant parties to assist in the identification of risks

2.2. Research risks that may apply to scope

2.3. Use tools and techniques to generate a list of risks that apply to the scope, in consultation with
relevant parties
 P a g e | 39

2.1 – Invite relevant parties to assist in the identification of risks

By the end of this chapter, the learner should be able to:
 Look at identifying risks with stakeholder assistance

 Interact positively with stakeholders

 Understand communication conventions and protocols.

Identifying risks with the help of others

Your invite to the relevant stakeholders, asking for their participation in identifying risks, will help raise
concerns and highlight areas not yet recognised. By including those parties that have a vested interest in
your organisation and workplace activities you are more likely to raise and recognise all associated risks.

Stakeholders can help identify risks in the following ways:

 Through reviewing workplace procedures

 When discussing work opportunities and business ventures or projects

 In performing workplace risk assessments within the workplace

 When documenting incidents and near misses

 When completing and checking workplace records

 Through asking questions and making observations.

Work health and safety

In matters of work health and safety, all employees need to be consulted and allowed to contribute in
risk identification and in making safety changes. As these directly impact on workers, they will need to
provide their comments and feedback when management are seeking to make health and safety risk
assessments and improvements. This may also include the presence of a health and safety
representative (HSR), a health and safety committee (HSC) and/or a work health and safety officer or
personnel.

Interacting with stakeholders

Your interactions and workplace communications can also be used to determine appropriate risk
treatment actions and the order that risks should be treated. (More on risk treatment actions can be
found in section 4.1 of this unit).

Techniques to use in your interactions include:

 Questioning – closed questions require short and direct answers
(e.g. ‘yes’ or ‘no’), these are good to confirm details and
understanding. Open questions require longer, informative
replies (e.g. as when asked a question such as ‘what happened
when you followed the current procedure?’), these are useful for
discussing subject matter in detail and for problem-solving.
 P a g e | 40

 Listening – active listening is repeating or paraphrasing back what has been spoken to
clarify understanding. Reflective listening involves the same as active listening, but
includes confirming the feelings or emotions of the speaker to gain insight into how
they feel.

 Open communications – this form of communication is about being honest and fully
open to discussions in order to share and explore information in an unbiased manner
and without repercussions. It can be used to fully understand viewpoints and to assess
areas of risk and the impacts.

Discussions should provide different opinions and the opportunity to fully investigate how stakeholders
work with risks. Highlighting occurrences and potential areas of risk will ensure you take the correct
measures to control and manage these.

Communication conventions
Conventions and protocols for carrying out your organisational
communications will need to follow accepted workplace practices. These
establish the groundwork for following good practice with all business
communication requirements, and will help to build successful working
relationships.

Communications may be:

 Formal

 Informal.

These conventions and protocols will be based on equitable practices which serve to promote
professional communications. Informal communications will be relaxed and less-guarded; these are the
communications that you have with colleagues and other employees, the people you know best.

Formal communications will tend to be those that you have with clients/customers and other external
stakeholders; these must represent the ideas and decisions of your organisation. You will need to take
care over confidentiality of information and appropriate use of language and words.

All communications should be conducted politely and with respect to other people’s viewpoints and
experiences.

Conventions and protocols may include:

 Following communication organisational procedures

 How you greet and speak to stakeholders

 Use of body language and gestures

 Documenting and reporting communications

 The process to invite stakeholders to meetings and engage in discussions

 Following-up on communications within a certain timeframe

 P a g e | 41

 Responding to communications within organisational communication timeframes.

Activity 2A
 P a g e | 42

2.2 – Research risks that may apply to scope

By the end of this chapter, the learner should be able to:
 Determine research methods

 Organise and present research appropriately.

Researching risks
Researching is a process that involves gathering information from as many different sources as possible.
For example, information may come from books and papers, word-of-mouth, proven facts and statistics,
and work reports. Using a variety of sources can help you to gain more information and viewpoints.

Sources of information must be:

 Reliable

 Reputable

 Verifiable

 Valid.

Set yourself a period of time to perform your research and to

identify the different areas and types of information that can assist
in your risk management. This will help you to keep working to
targets and any required deadlines.

Research should be done responsibly:

 Seeking permission to obtain information when needed

 Following organisational and communication protocols and procedures when obtaining

information

 Conducting courteous and professional communications

 Ensuring information is handled correctly, such as:

o maintaining confidentiality and data privacy

o storing information appropriately (e.g. securely/under lock and key if

confidential)

o never disclosing private information to those who do not have permission to

access this

o keeping records and information logs.

Researching also involves assessing and analysing the information. You will need to determine what you
are looking for, such as past accounts, incident statistics, and confirmation of events. Assessing for each
need will help you to understand the information as it applies to your risk management needs.
 P a g e | 43

Tools for performing research

When information is gathered, you will need to collate this in a presentable manner to allow you to see
and use data appropriately.

Written information may need to be scanned and stored digitally, or paper copies placed into relevant
files or folders. Data from database runs or computer logs may need to be taken and put into another
format, for example, Microsoft Excel spreadsheets, Word, PowerPoint, in another software program or
printed onto paper.

This will allow you or others to present data in the most effective way in order to assess information and
to show important features.

Information can be shown in:

 Tables

 Graphs

 Text

 Diagrams

 Illustrations, such as maps, charts

and graphics.

Information may need to be presented within an

organisational report or as individual research papers/results. Organise your research into an
appropriate form and ensure this is compiled and shown truthfully and without undue bias, as this may
affect your or other interpretations.

Numerical tools
Using software that allows you to look at and analyse figures can greatly assist in your numerical
analysis. This helps to order data and information quickly and easily, preventing the possibility of human
error. You can perform equations, section or separate data fields and create new pages with specific
information.

Software that configures numbers and enables calculations includes:

 Microsoft Excel

 MATLAB

 Intuit QuickBooks

 Apple numbers.
P a g e | 44

Activity 2B
 P a g e | 45

2.3 – Use tools and techniques to generate a list of risks that apply to the scope,
in consultation with relevant parties
By the end of this chapter, the learner should be able to:
 Work with others in risk management identification

 Understand and use tools and techniques to list risks

 Be aware of risk management strategies.

Tools to identify risks

Documentation is essential in assisting you in the process of identifying risk. It will help you to assess the
impact and likelihood of risk occurring. Seeing information on paper is a valuable way to make it real.

Make sure you use staff resources to help you identify risk; you could bring together a team of
experienced people to work on identifying and assessing the risk, or even bring in a consultant with
expertise in risk management.

Consult with all available and relevant persons who can help you identify and list the possible risks as
applicable to the scope.

Relevant persons may include:

 Department managers

 Health and safety representative

 Contractors and employees.

Use checklists and testing procedures, and prioritise risks by developing a system of scale to evaluate
high and low risks, such as a numerical scoring system. Checklists can be used to help identify the risk
factors, prioritising will let you know which are the most important or urgent to deal with.

To recap, risks may include:

 Commercial and legal relationships

 Economic circumstances and scenarios

 Human behaviour

 Individual activities

 Management activities and controls

 Natural events

 Political circumstances

 Positive risk
 P a g e | 46

 Use of technology

 Hazards in the workplace such as:

o physical hazards

o biological hazards

o ergonomic hazards

o psychological hazards.

An example of information in a risk checklist:

Risk checklist for Project X – new client business

Risk factors Risk

Project set-up Low risk – acquiring work space, work team, and resources

Staff resources No risk – recruited two personnel to manage project, assigned two
workers to project

Technology resources Low risk – ICT dept. booked to set up computer system/technologies

Team skills Medium risk – two workers require additional skills and knowledge

You and any designated others can use a range of techniques and tools to assess risks. Consultations
and discussions can also help bring together knowledge and experience; working together will allow you
to investigate risks and negotiate priorities.

Techniques, tools and processes for determining risks include:

 Qualitative analysis

o this involves plotting risks on a graph or matrix

o the likelihood of a risk occurring can be ranked horizontally, while the impact of
the risk can be ranked vertically

 Quantitative analysis

o this involves assigning numbers to risks according to whether they are highly
likely or highly unlikely to occur

 Speaking with colleagues, managers and supervisors

 Assessing in-house statistics and data relating to incidents, hazards and risks

 Examining equipment, materials and substances

 P a g e | 47

 Conducting a ‘Hazard and Operability (HAZOP)’ study

o a systematic approach to examining each separate part of a work practice,

identifying along the way all the associated risks

 Conducting a ‘Failure Mods and Effects Analysis (F.M.E.A.)’

o a F.M.E.A. is a ‘bottom-up method for assessing the ways in which the basic
elements of a system, process or piece of equipment can fail, leading to health
and safety risks

 The ‘Structured What-If Technique’ (S.W.I.F.T.)

o S.W.I.F.T. involves a team of experts brainstorming ‘what if?’ scenarios

o e.g. ‘What is there is a power cut?’ ‘What if there is a flood?’

Risk management strategies

Risk management is a two-stage process; identify the risk and control the risk. Develop a strategy (or
strategies) that will encompass these needs. Ensure all persons involved in identifying risk are thorough
in their process and detail the entire risk factors.

There are different approaches to manage risk and these include:

 Risk assumption – this strategy lets the other party know that there is an element of
risk involved, for example, building a new hotel that is scheduled to be open for
business by a certain date. If the hotelier is aware that this may not be completed in
time, he/she cannot expect to take issue if this is delayed.

 Risk avoidance – this strategy looks to avoid the risk by not taking the course of action
that could cause any negative impact to occur, for example, not using an unknown
manufacturer to make your products.

 Risk retention – this strategy accepts the potential risk because the successful outcome
far outweighs the negatives.

 Risk transfer – this strategy shares the risk by

either using another party to take on some of
the risk – for example, using a supplier to
source difficult to find parts – or by using an
insurance policy to cover the risk.
P a g e | 48

Activity 2C
 P a g e | 49

3. Analyse risks
3.1. Assess likelihood of risks occurring

3.2. Assess impact or consequence if risks occur

3.3. Evaluate and prioritise risks for treatment

 P a g e | 50

3.1 – Assess likelihood of risks occurring

3.2 – Assess impact or consequence if risks occur
By the end of this chapter, the learner should be able to:
 Understand different analysis techniques for assessing risk

 Use a risk categorisation to determine the likelihood of risks

 See the value of a risk matrix to show the level of risk.

Assess and analyse your risk factors

Look at the information you have gained and make an understanding on the risks that are involved. This
process is helped by using different analysis techniques; this provides you with additional focus on
target or high risk areas.

Analysing information is about forming a true understanding and can include:

 Statistical analysis – looking at data, facts and figures in information to provide
evidence of past situations, this is helpful for looking at straightforward data but will
not highlight any variables or influences that may have affected the outcomes

 Critical analysis – the term used for determining the worth of information in analysis;
this is usually from the analyst’s point of view and can be helpful when applying
personal experience and knowledge to a situation

 Predictive analysis – this can be used when looking at data and figures to look ahead at
predicting future occurrences, although not an accurate type of analysis, if using a
strong predictive model it can help you to make better decisions

 Causal analysis – this is looking at the cause (or root cause) to determine why
something has, or is, repeatedly happening so that this can be changed or eliminated to
prevent future occurrences; causes can operate in cycles and may be systemic within
the organisation

 Consequence analysis – this is about identifying the consequences of taking actions or

in making decisions, it can help you to look further along at organisational activities to
ensure you are aware of and factor in any other actions that may occur as a result

 Probability analysis – focuses on the possible

occurrences that may happen by looking at
historical data and information (past trends) and
applying that to the current situation.
 P a g e | 51

Correlations
Understanding correlations in data is useful as it helps determine the bigger picture. By identifying and
looking at the connections between information you can seek to understand the relationships that exist.
It also helps to tie together different information that may come from different sources.

Things that you may want to focus on in your analysis include:

 Stakeholder types and/or activities

 Organisational policy and procedures

 Organisational culture

 Economic and political influences

 Legislation and regulation

 Technology needs

 Current risk management arrangements

 The objectives and critical success factors identified in the scope

 The risks that may apply to the scope.

Risk categorisation
To help you with categorising the particular risk that may affect you, you should be aware that this
categorisation must be relevant to you and your organisation. You may start with a set categorisation
chart, but invariably to make this work accurately, you should bespoke this to suit your needs every
time you come to need a risk categorisation, adding as many levels as needed.

Construct a system of scale to help you determine how likely a threat or opportunity will be. You could
use the categorisation, as below, or choose a numerical system instead, for example 1-5 (1 being low
risk and 5 being high risk). By using a category for the likelihood of the risk against a category of the
consequences of the risk, you can build a clearer picture of each one.

Risk categorisation may include:

 Likelihood of risks:

o almost certain

o likely

o possible

o unlikely

o rare
 P a g e | 52

 Consequences of risks:

o insignificant

o minor

o moderate

o major

o catastrophic.

Both a worded or numerical categorisation will achieve a rating system that you can use with each risk
to determine its impact. Fine-tune the categories as much as you need to, so you can accurately assign
the risk level and look at preventing any negative consequences.

Risk matrix
A risk matrix categorisation provides an overview of the potential risks to show areas of concern and
any priorities that need to be worked on. This is a useful way to assess any probabilities of risk and to
determine the level of impact they may have.
As in the example below, this template risk matrix shows the scale for risks – just add the risk in the
appropriate box for assessment.
In order for a risk matrix to be successfully used, you should design a specific matrix for your particular
needs and carefully monitor individual risks through the project. If not used correctly the matrix will not
give you a clear indication of risk.
Example risk matrix template:

Likelihood of risk happening

Rare Unlikely Possible Likely Most likely

Impact of risk

Extreme LM M MH H H

High L LM M MH H

Moderate L LM M MH MH

Low L LM LM M MH

Very low L L LM M M

Key:
L – low risk
LM – low/medium risk
M – medium risk
MH – medium/high risk
 P a g e | 53

H – high risk.

The level of risks

Once you have identified the level of risk for each factor, you can look at the importance of how this
may affect your organisation and plan the best course of action. The potential impacts on your business
need to be seen.

Level of risk may include:

 Low, treated with routine procedures

 Moderate, with specific responsibility allocated

for the risk, and monitoring and response
procedures implemented

 High, requiring action, as it has potential to be

damaging to the organisation or project

 Extreme, requiring immediate action, as it has

potential to be devastating to the organisation
or project.
P a g e | 54

Activity 3A
 P a g e | 55

3.3 – Evaluate and prioritise risks for treatment

By the end of this chapter, the learner should be able to:
 Know the importance of prioritising risks

 Understand the hierarchy of risk controls

 See the value in making contingency plans.

Prioritise the risks

In order to manage and control risks, you need to evaluate their importance and impact. As seen in
section 3.1/3.2 of this unit, categorising risk and using a risk matrix can help determine which risks are
more important to manage first.

Once risks have been prioritised, you will then need to determine the best control methods to eliminate
or manage those risks at a safe level.

Hierarchy of risk controls

A hierarchy of risk controls exists in business to help organisations prioritise and manage their risks. It
can apply to all areas of risk management but is primarily concerned with work health and safety risks.

The below list of hierarchy controls is presented in order of effectiveness for controlling risk. Elimination
is the most successful solution to controlling a risk, and personal protective equipment (PPE) is the
option that is used last. Using a combination of risk controls may also be necessary and can increase
safety when controlling situations of risk.

1. Elimination – reorganise systems to remove the risk from the process

2. Substitution – change/swap to a lower risk option

3. Isolation – keep the risk away from others by making the area secure or off-limits

4. Engineering controls – use of appropriate mechanisms to prevent

hazard, such as increased ventilation

5. Administration controls – assess procedures

and revise working practices to eliminate the
risk, e.g. shortening work hours on a task or
rotating staff on a task

6. Personal protective equipment (PPE) –

provide safe and suitable equipment and
clothing to protect from the hazard, e.g.
safety goggles or use of gloves.
 P a g e | 56

Contingency planning
When evaluating risks in working procedures and systems, it is good
practice to address and formulate contingency plans; these can be used in
the unlikely event that an undesired situation actually happens.
Contingency planning allows for you and others to think and plan
alternative measures and actions to ensure work is continued and is
carried out safely.

This means that you and others can make well-thought and logical
decisions in a non-reactionary environment. You and your organisation are
able to take control of an unwanted situation without experiencing
unnecessary difficulties or duress.

Working with a contingency plan is similar to identifying

risk:
 Contingency planning is not just about the major risk or events that may occur, it also
includes those that may happen on a smaller scale

 It should be regarded as important to make contingency planning a standard part of

your everyday business operations

 Contingency planning is not a procedure or policy but more a systematic approach to

identifying what can go wrong in a variety of situations

 Contingency planning does not allow for thinking it will sort itself out or that if left
alone everything will turn out okay.

As in risk management activities, contingency planning will include options to identify the
likelihood and consequence of actions occurring or ignoring those actions:
 Likelihood – this represents the chance that something will happen

 Consequence – this represents the impact that a particular factor may have and is
measured in degrees of severity, or impact on your work plans

 Contingency – this is the planning you undertake to address the consequence.

 P a g e | 57

Activity 3B
 P a g e | 58

4. Select and implement treatments

4.1. Determine and select most appropriate options for treating risks

4.2. Develop an action plan for implementing risk treatment

4.3. Communicate risk management processes to relevant parties

4.4. Ensure all documentation is in order and appropriately stored

4.5. Implement and monitor action plan

4.6. Evaluate risk management process

 P a g e | 59

4.1 – Determine and select most appropriate options for treating risks
By the end of this chapter, the learner should be able to:
 Use a strategy for treating and controlling risks

 Know the importance of sequencing and scheduling work activities

 Apply the hierarchy of risk controls.

Strategies for controlling risk

To resolve issues of risk, a strategy of control will be needed. It will
depend upon the type of risk involved as to which strategy will work best.

Strategies to control risk include:

 Stop the risk – take away the process/element that is
causing the risk

 Treat the risk – stop the action causing risk and change
this action to include controls for risk elimination

 Transfer the risk – shift the element of risk elsewhere

 Tolerate the risk – on occasions where risk is

unavoidable and needs to be allowed for, make this as
safe a process as possible.

Decide upon the strategy and work to remove the risk. If you need to
consult with others, make sure this is done and the outcome is agreed. Time may also be required to
make effective plans and to gather all necessary resources and means to implement risk treatments.

Factors that may impact on risk treatments include:

 Expenditure and budgets, the cost to implement treatment and control measures

 Organisational and management needs and priorities

 Resource requirements, e.g. human or technical

 Time factors, e.g. when needing to implement policy or legislative changes.

Sequence risk control activities

Plan out the sequence and schedules for risk treatments; this will help create order within complex
tasks, and documents the identified activities. Use the available technologies at your place of work to
help you, for example, workplace computer systems to log and communicate information automatically
to employees or relevant others.
 P a g e | 60

Sequencing may include:

 Planning work activities

 Deciding the order for carrying out tasks

 Assigning roles and responsibilities

 Identifying the appropriate risk controls

 Organising and implementing risk controls

 Monitoring and reviewing risk controls and work activities.

Treatment options
Treating risks will depend on the chosen hierarchy of control, or controls. You may decide to try one
control with a view to reviewing this at a further date. Using more than one control may be required, for
example, isolating chemicals under lock and key in a building away from workers may also require
administrative controls to record details of who uses the key and when.

Risk treatment examples using the hierarchy of risk controls:

 Elimination – repairing damaged machinery so it is safe to operate

 Substitution – installing an improved security system in the workplace to prevent

visitors entering areas that are prohibited

 Isolation – locating hazardous chemicals away from work areas

 Engineering controls – changing a system of work to enable workers to work without

risk to health and safety

 Administration controls – recording work activities and documenting tasks

 Personal protective equipment (PPE) – wearing ear muffs to protect from loud
machinery noises.
 P a g e | 61

Porter’s Five Forces

The Porter’s Five Forces model allows you to look at where power lies in a business situation and how it
may affect your organisation. This helps you to assess your risk position in the market and the potential
to make profits by looking at the factors that can be changed to put the balance in your favour.

1. Supplier power – this depends upon your reliance upon using suppliers and how many
suppliers can offer you what you need. The fewer options you have, the more
dependent you are upon the supplier and their costs may increase.

2. Buyer power – this depends upon your buyers, whether or not they are willing to pay
what you charge for your products/services. If there are other opportunities for your
buyers to choose different organisations, the weaker your position will be and your
prices could be driven down.

3. Competitive rivalry – this depends upon how many competitors you have and how
comparative their products/services are. The less others offer the same as you, the
better your position will be.

4. Threat of substitution – if your products/services can be substituted for alternative

products/services by other organisations, this will weaken your strength in the market.

5. Threat of new entry – if the market is easy to enter and competitors can easily
establish themselves, this will weaken your organisation’s growth and profits. If the
industry you are in has many obstacles to entry this will protect the market.

Threat
of new
entry

Supplier Buyer
power power
Competitive
rivalry

Threat of
substitution
P a g e | 62

Activity 4A
 P a g e | 63

4.2 – Develop an action plan for implementing risk treatment

By the end of this chapter, the learner should be able to:
 Understand the need to make efficient plans to treat risks

 Know about risk action and treatment plans

 Know the use of a risk register.

Measures you can take

Risk measures and controls can vary tremendously, but all will originate from the hierarchy of controls
to provide the correct intention.

To control risk measures, you could:

 Look to using technology, e.g. you could use risk management software to monitor risk,
or perform evaluations and compile your results into spreadsheets for reviewing

 Confer regularly with those that see your progress, e.g. with your accountant/accounts
department or project managers

 Prioritise goals, focus on tasks and complete these before taking the next step
forwards.

Developing a plan to treat the risks

When determining the actions to treat the risks, you will need to have a thorough risk management
plan that details what the risks are, the identified risk treatments, who is responsible for carrying out
the treatments and the timeframes applicable to these.

Documentation that can help your plans:

 Risk action plan – to detail the risks(s) associated with an area, project, etc.

 Risk treatment plan – to describe the chosen control(s) for the risk(s)

 Risk register – to assign responsibilities for monitoring and managing the risks during
risk treatment.

A risk plan will highlight the concerns that you have, but will need to present a feasible course of action.
The correct approval procedures will need to be taken and it must fall within budget to work.
 P a g e | 64

To develop a risk control plan, you should consider:

 Hazard identification measures

 Risk assessment methods

 All identified hazards and their associated risks

 How likely it is that hazards and risks will cause

harm to employees and the organisation

 Which risk control measures are affordable,

workable and effective

 Risk triggers

 Short term and long term goals for reducing potential hazards and risks

o ideally, your ultimate aim is to eliminate all incidents and accidents that arise
from hazards

o you should identify short term and long term goals so that you can introduce risk
control measures gradually and monitor your progress over a set period of time

 Which employees should take responsibility for the risk control plan

 Methods of documentation

o you can document your risk control plan on paper or electronically.

 P a g e | 65

An example risk action plan could look like this:

Description of identified situation of risk:

(For example) an event to promote a hotel complex to increase customer bookings and organisational
reputation

Potential impact of risk: Comments on the risk:

Positive risk will result in customer bookings All staff involved will need to positively promote
Negative risk will result in poor customer interest the hotel and facilities and provide information
upon request, including tariffs and offers, to
ensure success

Recommendations: Proposed action:

 Plan and organise promotional activities
and materials
 Train staff to participate in the event
 Advertise the event
 Produce hotel brochure, leaflets on
current packages and deals, free gifts for
customers
 Run staff training over a two-day period

Staff involved and responsibilities assigned:

Department managers to oversee the event and assist in customer activities
Hospitality team to run event and presentations, and to talk with customers
ICT personnel to assist in set-up of presentation/demonstration technologies

Resources needed:
Conference suite/reception space, presentation and display equipment, promotional literature and gifts,
staff to host

Timelines: Deadlines:
6 week until event day 1 week to start promotion of event
3 weeks to perform staff training
4 weeks to produce promotional materials

Required reports: Frequency of reports:

Work progress update Twice a week
Budget report 1 week prior to event
Project report 1 week after event

Authorised by: A. Nother Date: 10/10/2016

Implementation comments: (To be confirmed)

 P a g e | 66

An example risk treatment plan:

Risk Hierarchy of Treatment Likelihood of Monitoring Person(s)

control(s) options risk occurring options responsible

Customers do Administration Ensure event is Medium Ensure H. Ospitality

not attend advertised and advertisements
event invites are sent are in the
correct place,
check invite
response
numbers

Customers do Engineering Ensure Low Check and ask H. Ospitality

not see the Administration customers are for feedback
value in the aware of the and invite
promotion reasons and responses to
benefits event

Staff do not Elimination Provide skills Low Attend training Department

interact well training and sessions and managers
with instruction to discuss event
customers staff with staff

Presentation Elimination Set equipment Low to Check with ICT ICT

does not work Substitution up day before medium on evening department
correctly event and test, before event
provide back- and on the day
up equipment

An example of a risk register:

Risk register for hotel event on 12/12/2016

Risk Person/dept. Date of Impact of likelihood Date action Follow- Risk

responsible action risk of risk complete up status
actions

Customer Hospitality To be sent Low Medium 17/10/2016 Check None

invites not 17/10/2016 attendees replies
sent in
time

Video ICT 11/12/2016 No display, Low to 12/12/2016 None None

equipment and lack of medium
does not 12/12/2016 technical
work capability
P a g e | 67

Activity 4B
 P a g e | 68

4.3 – Communicate risk management processes to relevant parties

By the end of this chapter, the learner should be able to:
 Understand different communication methods

 Use communication methods to suit business needs.

Communicate your risk management processes

Your communications should be clear and provide all the necessary details that apply to the situation. If
information is not given correctly, individuals with duties and responsibilities may lack direction or not
know when actions need to be carried out or completed.

Ensure your communications are appropriate to the parties involved and provide them with the facts
and information that they need. How and when you communicate will depend on the situation of risk. If
you are responsible for ensuring information is disseminated to other stakeholders, ensure you provide
a clear process for others to follow and access to the correct and most up-to-date information.

Communications can be:

 Verbal, such as:

o speaking directly with others, e.g. one-to-one or within a group setting

o telephone and video conference communications

 Non-verbal, such as:

o writing:

 emails

 letters, reports and other

documentation

 using databases and other

software programs

o how you present yourself to others

o use of body language and gestures

o using visual presentations to

communicate information.

Verbal communication
Verbal communications should be professional, courteous and respectful at all times. It is essential to
know how to relay information and how to conduct discussions; these will need to be tailored to suit
the audience, e.g. formal for managerial discussions and informational for team meetings. Your use of
language and terminology should be appropriate and enable understanding.
 P a g e | 69

You could inform others of risks at:

 Conferences and meetings

 Presentations

 Training and inductions

 Performance reviews

 Mentoring or coaching sessions.

It is important to understand social and cultural differences in

communication and ensure your approach and responses are appropriate. Take time to understand the
communication needs of your audience.

Verbal communications include:

 Addressing people in a suitable manner

 Articulating clearly and impartially

 Listening to others – use of active and reflective listening

 Asking questions to confirm and clarify meaning (open and closed questioning)

 Allowing others to speak, ask questions and contribute

 Acknowledging the contribution of others

 Performing negotiations to arrive at mutually acceptable outcomes (principled

negotiations)

 Facilitating an environment of open discussions and employee participation.

 P a g e | 70

Non-verbal communications
You should use non-verbal communication techniques with care and appreciation of the audience.
Meanings may differ between cultures and social groups; these can cause offence to some individuals,
however harmless a gesture may appear to be. Non-verbal communication can signify status, attitudes
and emotions which can be easy to misunderstand.

Aspects of non-verbal communication that may differ between cultures may include:
 Eye contact

 Body language

 Mannerisms

 Gestures

 Facial expressions

 Posture

 Personal space

 Touch.

When writing and compiling information, templates and plans,

ensure these are presented neatly and to organisational standards.
Using plain English will help aid understanding and will ensure you
do not over complicate texts. Make these simple to use and follow
for all relevant stakeholders.
P a g e | 71

Activity 4C
 P a g e | 72

4.4 – Ensure all documentation is in order and appropriately stored

By the end of this chapter, the learner should be able to:
 Know the value and importance of documenting risks

 Understand the need for templates and forms for employee use

 Store records and information in the workplace.

Documentation
Your organisation will need to keep records for legal
requirements and for any future analysis needs. All incidents of
risk need to be documented so that future occurrences of risk
can be avoided and your organisational systems can be
improved to better handle such situations.

Templates and copies of forms should be made available to staff

for their use and clear procedures should be explained so that all
employees follow the correct documentation processes. You
may have forms for risk assessment, incidents/accidents, risk
monitoring, risk matrix, risk register, etc.

Documenting the results of risk assessments

Documenting the results of risk assessments is a vital means of preventing and minimising the impact of
hazards on individuals and structures in the workplace.

By recording the results, as well as the process, of risk assessments, you will be better prepared to
safeguard the safety and wellbeing of all staff members, work property and organisational activities.

When documenting the results of risk assessments, you should include:

 Details of the hazard itself

o e.g. faulty electrical wiring

o including the location/origination of the hazard

 Why the risk assessment had to be carried out

 The time and date the risk assessment was conducted

 Who conducted the risk assessment

 A quantitative and qualitative evaluation of how likely an injury or illness will occur as a
result of the hazard

 A brief explanation of the reasons – or potential reasons – for the hazard’s existence
 P a g e | 73

 The measures taken to minimise the risk posed by the hazard

o e.g. power to the electric wiring was switched off

 What else needs to be done in order to minimise the risk posed by the hazard

 How similar hazards may be prevented in the future.

You may document the results of risk assessments either on paper or electronically; what is important is
that you document the results according to organisational procedure and file and store records in such a
way that relevant stakeholders can access particular documents.

Most organisations have special procedures in place for recording and documenting the results of risk
assessments; be sure to familiarise yourself with any procedures in place and follow them accordingly.
P a g e | 74

Activity 4D
 P a g e | 75

4.5 – Implement and monitor action plan

By the end of this chapter, the learner should be able to:
 Address implementing plans

 Know the importance of providing information to others

 Understand the need to monitor plans as risks may change.

Implementing treatment plans

A risk treatment plan is part of the risk management process and should be included in your action plan
to eliminate the negative risks and to look at promoting the opportunities, or positive risks. The
person(s) responsible for the treatment plan(s), if different to you/the project manager, will need to
confer with the appropriate person(s) to ensure that work is completed as and when expected.

Make sure that plans are complete and provide thorough guidance to deal with the hazards and risks
involved. When implementing plans and/or conferring with colleagues and employees on roles and
duties, make sure you discuss the requirements in full. Provide channels of open communication so that
questions can be asked and queries sorted; you should also give guidance and direction as and when it
is needed during the duration of work activities.

Treatment plans should include:

 An overview of your risk management needs

 Planning your response to dealing with situations of risk,

which will either be:

o avoiding the risk

o lessening the risk

o transferring the risk

o accepting the risk

 Documentation of the plan which may include:

o an outline of the approach being used to deal

with the risk

o the responsibilities assigned

o if the risks will be internal or external

o information on stakeholders involvement with the risk

o any approval/organisational processes involved.

 P a g e | 76

When looking at the treatment plan, make sure you factor in suitable timings to deal with your solutions
to risk. These will need to be appropriate to the purpose, for example, for a high rated risk it would not
be appropriate to have a long time period of 18 months to resolve the issue.

You may also need to consider:

 Maintaining budgets in consideration to any treatment plans

 Availability of any additional resources

 Communicating any treatment plans to other parties, such as company directors, staff,
stakeholders, clients or industry bodies and monitoring activities.

Operational risks
There are many ways that a business could incur risks in the workplace. Always be on the lookout for
potential situations of hazard. Along with health and safety aspects, other business operational risks
may occur. Your plans may have taken these into consideration, or you may meet further hazards and
risks along the way.

These include:
 Economic shifts

 Financial crisis

 Import/export problems

 Capital finance

 Product failure

 Information systems

 Cash-flow difficulties

 Issues with investors/borrowed capital.

Implementing a risk control plan

To implement a risk control plan effectively:
 Explain to colleagues the importance of risk control plans

 Train relevant colleagues in the execution of the plan:

o you may choose to do this via training days, workshops, seminars, etc.

o you may also have to run ‘refresher’ courses

 Encourage all employees to look out for hazards and to report anything they think
could be a problem, no matter how trivial

 Ensure employees stick to the plan

 P a g e | 77

 Remain observant throughout and monitor work activities.

 P a g e | 78

Activity 4E
 P a g e | 79

4.6 – Evaluate risk management process

By the end of this chapter, the learner should be able to:
 Monitor and evaluate risks

 Integrate risk management into working practices.

Monitoring risk
Make sure that you monitor risks on a continual basis. Changes can occur as work progresses and your
initial risk management strategy or processes may need adjusting over time. It also helps to monitor any
occurrences of residual risk and to identify ways of managing this.

It is prudent to make risk management a part of your regular work with colleagues and/or your team
and make time to discuss this at staff and team meetings. Look to integrate risk management processes
within your area of operation and encourage a working environment that seeks to maximise the
opportunities and diminishes the risks.

Record your findings in a format that highlights any issues in a concise manner and makes it easy to
focus on the points required.

You could monitor your information in the format shown below:

Risk Monitoring options Suggested Who is involved

improvements

E.g. Keeping work Security guard at Using a pass entry Security and facilities
premises secure reception and security system at reception and
guard on patrol of at the entrance to each
premises work area; two security
guards on patrol of
premises

Your responsibility
Managers should be responsible for providing correct and accurate information to all staff on areas of
risk and this should be checked to ensure it is supplied from a trusted source. Confidentiality of
information should also be respected; never pass on information that is subject to privacy status.
Always check on confidentiality clearance before disclosing information.

All information on your risk management processes and results should be current and regularly
monitored and reviewed for changes. Your reviews will help you to establish good practices and also to
determine what works well and what doesn’t work well in future work.

Risk management needs to be at an effective level to prevent any sudden and unexpected changes
within your work area and also within your organisation. To achieve the successful results, you would
like, make risk management a priority.
 P a g e | 80

Evaluating implemented risk controls

As with every business process, it is important to continually review and monitor the risk controls you
have implemented to reduce the potential harmful impact of hazards. This way, you can continually
review, tweak and improve the risk management process, which will lead to more efficient and effective
processes and thereby help to safeguard the safety and wellbeing of all staff members and the work of
the organisation.

You should evaluate implemented risk controls:

 At the outset of new projects

 Whenever there is a change in working practice or business

 Whenever there is a change or addition to the types of equipment, systems and

processes you use

 Whenever you move to a new premises, or when new work areas are opened.

To evaluate implemented risk controls, you should:

 Consider the advantages and disadvantages of using each measure

 Consider which measures are the most effective

 Consider which measures you can afford

 Consider which measures are realistically workable

 Consider whether your organisation has the employees with the required skills and
experience to use a particular measure

 Evaluate how likely it is that an injury/illness or negative impact will occur as a result of
a particular hazard, despite the risk control measures being in place

 Consider whether new changes to the workplace or working practice

necessitate new risk control measures

 Remain observant throughout all shifts.

Remember, it is simply good practice to regularly evaluate your risk controls. Set
specific times to do so and be sure to conduct all evaluations thoroughly, informing
management at all times of the process and results of each assessment.
 P a g e | 81

Activity 4F
 P a g e | 82

Summative Assessments
At the end of your Learner Workbook, you will find the Summative Assessments.

This includes:

 Skills assessment

 Knowledge assessment

 Performance assessment.

This holistically assesses your understanding and application of the skills, knowledge and performance
requirements for this unit. Once this is completed, you will have finished this unit and be ready to move
onto the next one – well done!
 P a g e | 83

References

These suggested references are for further reading and do not necessarily represent the contents of
this unit.

Websites
The Australian Human Rights Commission: https://www.humanrights.gov.au/our-work/legal/legislation

The Office of the Australian Information Commissioner (OAIC) website (the Privacy Act):
https://www.oaic.gov.au/individuals/privacy-fact-sheets/general/privacy-fact-sheet-17-australian-
privacy-principles and https://www.oaic.gov.au/privacy-law/privacy-act/

For information on Environmental legislation for business:

https://www.business.gov.au/Info/Run/Environmental-management/Environmental-legislation

For information on ISO 31000, visit the ISO website:

http://www.iso.org/iso/home/standards/iso31000.htm

Risk Management Institute of Australasia: http://www.rmia.org.au/

Publications
Safe Work Australia publication ‘Model code of practice – How to manage work health and safety risks’:
http://www.safeworkaustralia.gov.au/sites/swa/about/publications/pages/manage-whs-risks-cop

All references accessed on and correct as of 27.09.2016, unless other otherwise stated.