code of practice – whs risk management · whs risk management code of practice page 5 of 25 have...

CODE OF PRACTICE – WHS RISK MANAGEMENT

This publication has been prepared by Arrium Limited. This document is for internal use only and should not be used outside of the Arrium Group.

© Copyright Arrium Limited 2012. All rights reserved.

WHS Risk Management Code of Practice Page 1 of 25

Authorised By: Arrium OHSE Council Doc: ARI-WHS-RM-COP-001

Issue Date: 20/12/2016 Version: 4

Arrium Safety Intranet version is the only controlled version

Table of Contents

Scope and Purpose ...................................................................... 2 1.1. Codes of Practice Guidelines .............................................. 2

2. Critical Elements ......................................................................... 3

3. Code Requirements and Guidelines ......................................... 4

3.1. Safe Systems of Work ......................................................... 4 3.2. Guide to Risk Management ................................................. 6 3.3. Consultation and Communication ........................................ 7 3.4. Establishing the Context ...................................................... 8 3.5. Hazard Identification ............................................................ 8 3.6. Risk Assessment ................................................................. 9 3.7. Evaluation and Control of Risks ........................................ 10 3.8. Monitor and Review of Risks ............................................. 12

4. Training and Competence ........................................................ 14

4.1. Awareness Training ........................................................... 14 4.2. Competent Person Training ............................................... 14

5. Responsibility, Authority & Accountability ............................ 15

6. Definitions ................................................................................. 16

7. Reference Material .................................................................... 17

8. Appendices ................................................................................ 18

Appendix 1 – WHS Risk Management Overview ....................... 18 Appendix 2 – WHS Risk Control Guidelines ............................... 19 Appendix 3 – WHS Risk Rating and Prioritisation Table ............ 21

of 25 WHS Risk Management Code of Practice

Scope and Purpose

Each Arrium site is required to comply with this Code.

1.1. Codes of Practice Guidelines

This Code should be read in conjunction with the CoP Guidelines. The Guidelines provide information that is generic across the CoP, covering:

CoP scope

system requirements, including risk management, audit and review, and Variation procedure

training and competence

responsibility, authority and accountability for General Manager, Plant/Location/Department Manager, Responsible Manager

definitions

reference material.


2. Critical Elements

The Critical Elements must be conveyed and understood at each Arrium site.

1. Stop and report any hazards you cannot resolve to your Team Leader.

2. Verify operating and maintenance procedures are in place for routine activities and based on risk assessment processes.

3. Follow risk controls as documented in approved work procedures.

4. Carry out a Pre-task Risk Assessment if there is not an approved work method for the task.

5. Document and control risks from identified hazards.


3. Code Requirements and Guidelines

Risk Management at work is our proactive, fundamental way of recognising what could cause injury and providing controls so that people are not injured.

Following recognised risk management systems and processes provides a consistent and effective way of preventing injury.

This section outlines the requirements to be fulfilled in relation to the management of risk.

3.1. Safe Systems of Work

Develop, document and implement systems to identify, assess, control and review hazards and risks.

Hazards to be identified and risks assessed and controlled in a planned and scheduled manner. This is to occur:

before setting up and using a workplace

when planning work processes

before installing, commissioning or erecting plant

whenever changes are made to the workplace

when the system or method of work is changed

when plant or substances are used

when new information on processes becomes available

during the review process of control measures.

Risk management tools may include:

informal risk assessments (RA)

Pocket Risk Assessment (PRA)

job safety analyses (JSA)

hazard operability studies (HAZOP)

permit to work systems

safe operating systems

modification control procedures.


Have systems in place for recording hazards and the management of risks.

The Arrium data management system (or similar) should be used as a risk register to record:

identified hazards

risk assessments

risk control measures

monitoring processes

related responsibilities and timeframes for activities.

Develop and implement safe operating procedures (SOP).

This includes identifying requirements for routine maintenance and cleaning.

Procedures to be based on risk assessment.

Follow SOP and risk controls.


3.2. Guide to Risk Management

Follow the International Standards (ISO) for Risk Management when determining the approach to use for each risk situation.

The ISO risk management process includes:

consultation and communication

establishing the context

hazard identification

risk assessment

evaluation and control of risks

monitor and review of risks.

The WHS Risk Management Overview has examples of Arrium risk management methods, procedures, forms and records.

Refer to Appendix 1 – WHS Risk Management Overview.

Refer to ISO 31000 – Risk Management.

Record risk management activities according to site systems and procedures.

The Arrium data management system should be used for the recording of risk management activities.


3.3. Consultation and Communication

Communicate and consult with relevant people at each stage of the risk management process.

Consultation is required when:

risks to health and safety are examined or reviewed

determining measures to eliminate or control risks

introducing or altering procedures for identifying and monitoring risks

changes are proposed to the system of work, or the plant and substances used for work.

Document consultation about the management of workplace hazards and risks.

Document consultation for future reference.

Examples include:

names of people involved in risk assessment teams on risk assessment and modification control forms

WHS meeting minutes

Toolbox Talks/Safety Communication Meetings.


3.4. Establishing the Context

Determine the risk management process to evaluate risks.

Consider the context of the risk situation, to determine the method for conducting the risk management process. For example, determine:

which risk management tool is the most appropriate for the risk (e.g. PRA, JSA, HAZOP)

how the risk should be assessed and evaluated

who should be involved (e.g. specialists for technical advice)

the appropriate time frame (e.g. urgency of the hazard/risk)

where the process should occur (e.g. on-site, central location, in hazard and risk area, in office area)

how the process should occur (e.g. coordination of consultation, engagement of specialists).

3.5. Hazard Identification

Identify hazards in the workplace.

Hazards are to be identified proactively, before and during work activities, as well as in the workplace generally. Hazard identification can be triggered using many methods, as detailed in the WHS Risk Management Overview.

Refer to Appendix 1 – WHS Risk Management Overview.

Complete a pre-task risk assessment (PTRA) where there is not an approved work method for the task.

Even where approved work methods exist, unique or unusual circumstances may require PTRA.


3.6. Risk Assessment

Assess risks according to the Arrium WHS Risk Rating Table.

Identify, evaluate and take existing controls into consideration when conducting risk assessment.

Estimate:

the most realistic consequence that an interaction with a hazard might result in, and

the likelihood of that consequence occurring.

Risk level can be determined by either the two parameter (consequence and likelihood) or three parameter model (consequence and likelihood, where the probability and frequency of exposure to risk determines the likelihood).

Determine level of risk by adding consequence level and likelihood level. This analysis should consider the range of potential consequences and how these could occur.

Where possible involve more than one person in the assessment of risks (e.g. a person involved in the task being assessed and an independent person).

In determining the risks, review relevant information:

hazard information – safe operating procedures (SOP), on-the-job training guides (OTJTG), policies, safety data sheets (SDS)

experience within the workplace - records and observations by employers and employees, incident/injury data

legislative requirements

industry codes of practice

WHS statutory authority guidance material

Australian Standards.

Refer to Appendix 3 - WHS Risk Rating and Prioritisation Table.


3.7. Evaluation and Control of Risks

Evaluate the risk.

Review the estimated levels of risk against the WHS Risk Control Guidelines considering the balance between potential benefits and adverse outcomes.

Determine if actions are required to control the risks.

Refer to Appendix 2 – WHS Risk Control Guidelines

Follow the Hierarchy of Controls to select risk control measures.

Develop and implement controls that are reasonably practicable to implement and action plans to address the identified hazards and risks.

Control measures below are listed in order of decreasing effectiveness. This means that measures closest to the top should be adopted where practicable:

Note: In most cases a combination of control measures from the Hierarchy of Controls provides the most effective solution.

Eliminate the Hazard – remove the hazard from the workplace/work process.

Substitute the Hazard – substitute with a hazard that poses a lower risk of harm (e.g. the use of less hazardous chemicals, materials or different equipment).

Isolate the Hazard – enclose the hazard (e.g. barriers and fencing enclosures), remote handling, isolate by distance/time.

Implement Engineering Controls – for example, ventilation systems, machine guarding.

Administrative Controls – for example, safe work methods, training, job rotation, warning signs, supervision.

Personal Protective Equipment (PPE) – for example, hardhat, hearing protection, respirators.

Several controls may be required to control the risks.


Immediately act to reduce any risk that has a ‘Very High’ rating, to a rating of ‘High’ or lower.

If it is not possible to immediately put controls in place, then the process or activity must be stopped to address the hazard. The process or activity can re-commence once controls are put into place and the risk is reduced.

Implement controls according to risk prioritisation criteria.

Implementation includes verification of the effectiveness of controls.

Refer to ARI-WHS-RM-TOOL-001 WHS Risk Rating and Prioritisation Table on the Arrium Safety Intranet.


Where there is a risk that cannot be resolved, stop activity and report it to Team Leader.

Review residual risks.

Undertake a further risk assessment to determine the level of risk following implementation of controls. Implement further controls if risk is not adequately reduced.

Record the risk (with controls implemented) in the Arrium data management system/risk register or suitable format.

Identify risks for which the rating is ‘as low as reasonably practical’ (ALARP).

These should be identified in the Arrium data management system/risk register or similar.


3.8. Monitor and Review of Risks

Maintain risk register.

Update risk register where appropriate when:

new hazards are identified

there are changes to processes, plant, substances (including commissioning/decommissioning of plant)

reviewing risk assessments

there are new requirements (e.g. legislative, industry, organisational).

Monitor the effectiveness of control measures.

Existing control measures need to be reviewed to verify that changing circumstances have not reduced their effectiveness.

Monitor the effectiveness of the risk management process.

This is for the purpose of continuous improvement and includes reviewing risk register at appropriate intervals.

Systematically review the risk register to verify that:

new risks are being included where appropriate

new risks have controls prioritised to reduce risk

existing risks are being controlled

existing risks are ALARP.


Review ‘Very High’ risks that are managed with administrative controls annually.

Administrative controls for ‘Very High’ risks need to be reviewed to verify that they are effective.

The Arrium data management system (or similar) should be used as a tool to schedule review periods.

Risk control effectiveness review periods are contained in the WHS Risk Control Guidelines.



4. Training and Competence

The training provided to individuals is to be determined by training needs assessment.

Training requirements that are generic across the CoP are described in the CoP Guidelines. In addition, the following training requirements are specific to this CoP.

4.1. Awareness Training

Provide awareness training to employees and site contractors.

Training to provide knowledge of:

hazards and hazard identification

reporting of hazards

overview of risk assessment process

Hierarchy of Controls.

Include awareness training in general induction.

4.2. Competent Person Training

Provide training and assessment for employees performing risk assessments.

Training is to be specific for the risk management process to be used.

For example, varying levels of training will be required to conduct PTRA, to complete JSA, or be involved in HAZOP.


5. Responsibility, Authority & Accountability

Responsibilities that apply to all CoP for General Managers, Plant/Department/Location Managers, and Responsible Managers are described in the CoP Guidelines.


6. Definitions

Arrium data management system

The workplace health and safety management system including its databases, policies, procedures and processes.

As Low As Reasonably Practical (ALARP)

Risks that are at a tolerable level based on the application of controls that are reasonably practicable.

Consequence (C) The harm to people, environment, property and/or process resulting from the hazardous/risk scenario.

Hazard A potential source of harm to people, environment, property and/or process.

Likelihood (L) The probability of the consequence occurring when exposed to the risk scenario.

Risk The consequence from a hazardous scenario and the likelihood that the consequence will occur.

Risk Level A descriptive rating linked to the risk rating. This includes Low, Moderate, High or Very High.

Risk Rating A numeric value assigned to a specific risk by adding the Consequence (C) and the Likelihood (L), assessed from the risk rating definitions.

Risk Register A database of hazards and their associated risks showing initial risk rating, current risk rating, planned or existing controls, and ALARP status.


7. Reference Material

The material listed in the Arrium WHS Legislative Matrix may provide additional information to assist in the implementation of this CoP.

Note: The currency of the reference material listed in the Arrium WHS Legislative Matrix should be confirmed.

Arrium WHS Legislative Matrix (ARI-WHS-LEG-TOOL-021)


8. Appendices

Appendix 1 – WHS Risk Management Overview


Appendix 2 – WHS Risk Control Guidelines

Identification, Planning & Implementation of Risk Controls

The Arrium WHS Risk Management CoP requires that corrective actions be implemented for identified risks and each business shall have a program for those controls that systematically addresses their risk profile.

The key principle is that sites are to have an active risk register and be able to demonstrate that they are actively addressing the highest rated risks. The key philosophy is that the risk management process is a method of determining priorities and items to address first, thus sites are encouraged to focus on the top priority risks rather than all risks.

Control measures implemented to manage a risk should be reviewed and monitored to determine if changing circumstances have altered the control measures required to effectively manage the risk.

When reviewing risks, it is good practice to review each of the risks for a particular hazard based on review period for the highest ranked risk.

The following table outlines the risk control priorities, timeframes to assess and decide on controls, and timeframes for review of risk control effectiveness.

Low Risk Moderate High Very High

Risk Control Priorities

Manage by routine procedures

Responsibility and action dates must be specified

Reduce as soon as possible

Immediate action to reduce risk, stop work as soon as practicable

Time to Assess and Decide on Controls

60 days 60 days 10 days 24 hours

Implement Additional Controls

12 months 60 days 30 days 24 hours

Review of Risk Control Effectiveness

36 months 24 months 12 months Not applicable (risks to be reduced)


Appendix 2 (continued)

Qualifying Notes

Low Risk – Manage by routine procedures

The level of risk is such that resources are most probably better directed at addressing higher rated risks. When a risk is identified and rated as a low risk, and the business context warrants additional controls then a reasonable timeframe would be for implementation of the controls to be performed using routine methods within 365 days.

Moderate Risk - Responsibility and action dates must be specified

Resources should be allocated to higher rated risks first. An action plan that outlines planned controls or steps to determine planned controls and allocates responsibility should be developed within 60 days.

High Risk - Reduce as soon as possible

Where a risk scenario has been rated as high risk, the existing controls should be reviewed and any further controls that are reasonably practical identified and implemented as soon as possible, preferably within 30 days. There may be situations where a risk has been identified and rated as high risk and after due consideration no further controls are reasonably practicable or known (ALARP), in such cases the General Manager shall determine whether the risk scenario is to be tolerated. Similarly, there may be cases where additional controls may take longer than 30 days, in such cases the General Manager shall confirm that the timeframe is acceptable within the context of the specific risk scenario.

Very High Risk - Immediate action to reduce risk, stop work as soon as practicable

Immediate (within 24 hours) interim controls should be implemented to protect persons from the hazard. Prior to the stopping of work assessment should be made to check whether any additional risks might be introduced by stopping the process and appropriate controls implemented.

Given the subjective nature of the risk rating method, good practice is to seek a greater understanding of the hazard and risk and confirm the level and nature of risk prior to establishing further controls once initial controls have been implemented.


Appendix 3 – WHS Risk Rating and Prioritisation Table

Consequence Categories

Level Rating Description (Safety)

1 Negligible Negligible Low-level short-term subjective inconvenience or symptoms. No measurable physical effects. (E.g. minor laceration, burn or abrasion requiring basic first aid)

2 Minor Objective but reversible disability / impairment. (E.g. laceration, sprain/strain, burn etc. that requires medical treatment and/or modified duties)

3 Medium Moderate short-term or irreversible disability or impairment. (E.g. fracture, crush injury, burns etc requiring specialist medical and/or hospital treatment)

4 Major Near fatality, Single fatality or severe irreversible disability or impairment. (E.g. loss of life, loss of limbs, loss of bodily function such as major paralysis)

5 Extreme Short or long term health effects leading to multiple fatalities. (E.g. as for 4 but with multiple victims)

Likelihood Categories

Level Rating Description

1 Rare The event may occur only in exceptional circumstances (1 chance in 10,000 per year)

2 Unlikely The event could occur at some time (1 chance in 1,000 per year)

3 Possible The event might occur at some time (1 chance in 100 per year)

4 Likely The events will probably occur in most circumstances (1 chance in 10 per year)

5 Almost Certain

The event is expected to occur in most circumstances (1 chance per year)

Note: Add consequence and likelihood to achieve risk rating


Appendix 3 (continued)

Risk Rating Table

Negligible Minor Medium Major Extreme

1 2 3 4 5

Almost Certain 5 6 7 8 9 10

Likely 4 5 6 7 8 9

Possible 3 4 5 6 7 8

Unlikely 2 3 4 5 6 7

Rare 1 2 3 4 5 6

Risk Prioritisation

Risk Level Suggested Actions

Low Manage by routine procedures

Moderate Responsibility and action dates must be specified

High Reduce as soon as possible

Very High Immediate action to reduce risk, stop work as soon as practicable


Notes

Consequence Categories

Level Rating Description (Safety)

1 NegligibleNegligible Low-level short-term subjective inconvenience or symptoms. No measurable physical effects. (Eg. minor laceration, burn or abrasion requiring basic first aid)

2 MinorObjective but reversible disability / impairment. (Eg. laceration, sprain/strain, burn etc. that requires medical treatment and/or modified duties)

3 MediumModerate short-term or irreversible disability or impairment. (Eg. fracture, crush injury, burns etc. requiring specialist medical and/or hospital treatment)

4 MajorNear fatality, single fatality or severe irreversible disability or impairment. (Eg. loss of life, loss of limbs, loss of bodily function such as major paralysis)

5 ExtremeShort or long term health effects leading to multiple fatalities. (Eg. as for 4 but with multiple victims)

Likelihood Categories

Level Rating Description

1 Rare The event may occur only in exceptional circumstances (1 chance in 10,000 per year)

2 Unlikely The event could occur at some time (1 chance in 1,000 per year)

3 Possible The event might occur at some time (1 chance in 100 per year)

4 Likely The events will probably occur in most circumstances (1 chance in 10 per year)

5 Almost Certain The event is expected to occur in most circumstances (1 chance per year)

Note: Add consequence and likelihood to achieve risk rating

Risk Rating TableNegligible Minor Medium Major Extreme

1 2 3 4 5

Almost Certain 5 6 7 8 9 10

Likely 4 5 6 7 8 9

Possible 3 4 5 6 7 8

Unlikely 2 3 4 5 6 7

Rare 1 2 3 4 5 6

Risk Prioritisation

Risk Level Suggested Actions

Low Manage by routine procedures

Moderate Responsibility and action dates must be specified

High Reduce as soon as possible

Very High Immediate action to reduce risk, stop work as soon as practicable

Arrium WHS Risk Rating and Prioritisation Table

CODE OF PRACTICE – WHS RISK MANAGEMENT

code of practice – whs risk management · whs risk management code of practice page 5 of 25 have...

Documents