GUIDELINE ACTIVITY RISK MANAGEMENT GUIDELINE. Purpose

Transcription

1 GUIDELINE ACTIVITY RISK MANAGEMENT GUIDELINE Contact Officer Director, Risk Management Purpose The risk management process is often complex and requires the exercise of good judgement. This guideline provides advice based on university sector best practices to assist Activity Coordinators and Persons in Authority in interpreting the Activity Risk Management Policy and following the Activity Risk Management Procedures. In addition, the Risk Management Office is available to provide assistance to departments with unique activity risk profiles, such as nursing or education placements. Guideline Many university activities are considered low risk because they either: a. entail risks that are no greater than the participants would face in their normal working and studying environment, such as classroom lectures, or b. entail risks for which established risk control measures are already in place and appropriately documented, such as Laboratory Safety Procedures. However, activities that entail risks greater or different than those encountered in the regular working and studying environment and for which there are insufficient risk controls in place to reduce the risk to a tolerable or manageable level are considered high risk. A risk assessment must be carried out for existing high risk and all new activities so that the foreseeable risks are appropriately managed. The Risk Management Plan may be used for this purpose. Step 1 Identify Hazards Section 1 of the Risk Management Plan can be used to identify the components of each activity. You can then consider what hazards or conditions might cause each component to fail. There are a number of systems analysis techniques for doing so such as fault or logic trees (envision a critical incident and work back listing the causes and conditions that must be in place for the critical incident to occur). Others include simply asking what if questions and considering worse case scenarios. Examples of hazards include: research or study at industrial or medical facilities which pose health or safety risks; working/traveling in remote regions or regions with natural hazards such as rugged terrain or the potential for avalanches; 1

2 Any activity that involves travel through or to a country or region for which a travel or health warning is in effect; Recreational or social activities conducted by participants during their personal time; Activities that involve the consumption of alcohol; Transportation to a site by private vehicles or a non-accredited commercial carrier; Working at heights, with power tools, on construction sites, in confined spaces or in any other circumstances regulated by the Occupational Health and Safety Act; Working with unstable persons or having control of large amounts of cash or other attractive items; Working with animals; Working with chemical, biological or nuclear substances that are capable of causing injury or death to persons, animals or vegetation, or environmental damage; Working alone; No established procedures for emergency response; No clear chain of responsibility; Assumption of liability without appropriate contractual indemnification (eg. Student placements, loans of research materials, provision of services etc) Large gatherings; and Extreme or inherently dangerous physical activities such as sky diving. The first column of Section 2 of the Risk Management Plan can be used to list hazards. Step 2 Assess risk Risk assessment requires the exercise of good judgment, based on expertise, previous experience conducting similar activities, previous critical incidents, loss histories (including near misses) and, where necessary, consultation with suitably qualified individuals or organizations. The experience of other universities with similar activities and loss statistics from our insurers, the Ministry of Labour and Statistics Canada may also be helpful. As well, Activity Coordinators should take changes in legislation and emerging trends relevant to your activity into consideration when estimating risk. The following guides can be used to determine the likelihood and severity of loss relating to each hazard: Descriptor Likelihood 1 Very low 2% likely to happen -rare 2 Low 5% likely to happen -once/10 yrs 3 Medium 10% likely to happen - once/3 yrs 4 High 20% likely to happen once/yr 5 Very high 50% likely to happen several times/yr Severity descriptors Possible consequences Examples* 1 - Insignificant No impact 2

3 2 Minor Negative outcomes from risks or lost opportunities that are unlikely to have a permanent or significant effect on the University s reputation or performance 3 Moderate Negative outcomes from risks or lost opportunities that will have a significant impact on the University but can be managed without major impact in the medium term 4 Serious Negative outcomes from risks or lost opportunities with a significant effect that will require major effort to manage and resolve in the medium term but do not threaten the existence of the institution in the medium term 5 Very serious Negative outcomes from risks or lost opportunities which if not resolved in the medium term will threaten the existence of the institution Less than $300,000 loss No regulatory consequence Minor adverse publicity Minor reversible injury Financial loss from $300 to $500K in any year Limited regulatory consequence Local adverse publicity Major reversible injury Financial loss over $500,000 in a single year Major savings program required to break-even in the medium term Significant regulatory consequence Negative headlines in the national press Irreversible injury or death Financial loss (or loss of potential financial surplus) over $500,000 for consecutive years Substantial regulatory consequence Sustained negative headlines in the national press Major negative sanction by MTCU Closure of major part of business Irreversible multiple injury or death University settles in dismissal case Lecturer has a work related injury e.g. slips Major IT project is late or overspent Contractual staff injured due to University negligence Loss of a major contract Research team found to have falsified results with a major impact e.g. on health issues Major recruitment problems due to pandemic may have the potential to escalate to very serious University financial systems fail completely and cannot be recovered Major accident due to University negligence Major fire that prevents a substantial part of the University delivering courses Collapse in student application numbers Sustained failure to recruit staff Select the descriptors that best describe the likelihood or severity of the potential loss, then multiply the scores assigned for likelihood and severity to determine a risk score for each hazard. Analysis of the resultant risk score will assist the person in authority with determining the university s risk tolerance for that hazard. For example, slips trips and falls generally result in minor losses to the university in terms of cost and adverse publicity. However, they happen with such frequency that the cumulative effects result in a medium score of 10 that warrants the implementation of risk control measures to reduce the impact on the university. Conversely, an active shooter incident resulting in the death of one or more persons is extremely unlikely, however the impact on the university in terms of adverse publicity could be extreme given the duty of care for our students. Therefore, despite the low risk score, the university has a very low tolerance for this sort of loss and will implement appropriate risk control measures. 3

4 Severity (Impact) High Medium Low Probability (Likelihood) Step 3 - Special considerations for off campus travel. Under normal circumstances, travel within Canada or most destinations in the United States for conferences, visits to academic or related institutions such as museums, local field trips of short duration, clinical placements at accredited institutions in Canada, and domestic travel by varsity athletic teams and athletic clubs via reputable commercial carriers are considered activities of low risk. Travel to countries other than the US should be evaluated to determine whether it entails low or high risk. The Department of Foreign Affairs, Trade and Development (DFATD) website thoroughly describes the current risks for each country, and issues travel warnings that should be followed. In particular, travel through or to a country or region where unusual conditions such as political instability, medical conditions or a natural disaster are known to exist prior to departure or for which a travel warning is in effect is deemed to entail high risk and requires the associated level of advance planning and approval. If the Activity Coordinator wishes to disregard a DFATD travel warning, they must obtain approval from the Person in Authority (Level 2 - high degree of caution or Level 3 - avoid non-essential travel) or the Senior Administrative Position (Level 4 - avoid all travel) to do so. All international activities involving undergraduate student participants are deemed to fall into the high risk category. Section Three of the Risk Management Plan has a section on International Travel requirements that must be completed. Step 4 Select Risk Control Measures The types of risk control measures available are: Avoidance. Completely avoid the hazard to eliminate the risk, either by not conducting an activity or not conducting certain high risk aspects of a particular activity. Example: A sociology professor is doing research on the effects of post traumatic stress on Canadian military members and wishes to interview military members in Afghanistan. The risk of death or injury when travelling in Afghanistan is hig. Risk avoidance would be to conduct the interviews in Canada, when the military members return from their deployment. 4

5 Risk prevention. Reduce the likelihood of the hazard resulting in a loss. Example: A new employee with no prior lab experience is required to use caustic chemicals in the lab, therefore the risk of him injuring himself is medium to high. A risk prevention measure would be to train the employee in the proper handling of the chemicals to reduce the likelihood of an injury. Risk reduction. Reduce the severity of any loss. Example. Employee handling chemicals. To reduce the severity of any injury, even after proper training, provide personal protective equipment such as goggles and fume hoods so if a spill does occur, the resulting damage is less severe. Also have a plan to obtain medical assistance as quickly as possible to minimize the impact of the injury. Duplication. Maintain backups, spares or copies in reserve, so that an operation can continue if the primary asset is lost. Examples range from data backup disks stored off site to having spare infrastructure and equipment. Separation. Reduce the immediate impact of a loss on an activity. An example would be storing essential supplies in two locations so if one is destroyed by fire, the activity can continue pending replenishment. Diversification. Conduct a variety of activities in a variety of locations so if one is lost, the others can continue to meet the strategic goals of the institution. An example would be to have a wide variety of research initiatives underway at any time. Transfer using contracts, hold harmless agreements, informed consent forms (waivers) and insurance programs to transfer potential financial loss to a third party. An example clearly defining personal time and explicitly stating that Trent has no liability for participants engaging in activities during their personal time. Recovery a recovery plan is a type of risk reduction measure. Should an injury or loss occur, your risk management plan should identify the means of managing the loss. For example, if a research vehicle is stolen, you should have insurance, contacts and financial resources in place to replace the vehicle. If a person is injured in a remote location, there should be a plan in place to provide emergency medical care. Select specific risk control measures that best mitigate the risks posed by each identified hazard and enter them in the Risk Control Measures column of the Risk Management Plan. More than one risk control measure can be used to address a hazard. For example, a graduate student required to travel around the boreal forest in winter faces a number of natural hazards (extreme weather, animal predators, rough terrain). Risk prevention methods might include ensuring the snow mobile is well maintained and has extra gas onboard and that the grad student has appropriate navigation aids, and is armed and well trained in the use of a firearm. Risk reduction methods may include a satellite phone to obtain assistance, a first aid kit, emergency supplies and survival training. Duplication methods may include carrying cross country skis. Keep in mind that implementation of risk controls may require additional resources, which should be identified in your plan. The selected risk controls should be cost effective. For example, installing a $500,000 camera system to deter annual losses from theft of under $5000 would actually incur a greater net income loss than the risk it is designed to control. 5

6 However, if the camera system is designed to deter assaults of persons working late at night, it may be well worth the investment. Risk controls for out of country or remote travel should include a plan for obtaining medical assistance and emergency repatriation. Once you have determined appropriate risk control measures, re-assess the residual risk, following the procedure at Step 2, to determine if the risk is now in the low, or manageable, range. Implementation of risk control measures should reduce the likelihood and/or potential severity of an accident, therefore lowering the residual risk score. The Person in Authority must then determine if the residual risk exceeds the university s risk tolerance. For example, the university has an extremely low tolerance for preventable student death. If, despite all the measures noted above, there is still a medium residual risk of student death, the risk is still unmanageable and the activity should not be approved unless the risk can be brought down to low. Requiring the students to travel in pairs may sufficiently reduce the risk score. If the risk involves only minor damage to university property, the university tolerance is high and a medium residual risk would be acceptable, especially if the risk control measures are more costly than the potential losses. Section Three of the Risk Management Plan provides checklists of some basic risk control measures that should be in place for all activities to address persons with special needs and emergency procedures. Steps 5 and 6 Obtain Approval. Submit the Risk Management Plan to the Person in Authority. The Person in Authority may approve the Plan as written or ask the Activity Coordinator to revise the plan in such a way that the activity s risks are reduced to a manageable level. If, in the judgement of the Person in Authority, the risk level cannot be brought to manageable levels, s/he will not approve the activity. The Person in Authority should consider the value of the activity to the university and determine if the goals of the activity could be met in another, less risky manner. An activity that involves risks which are manageable for an experienced individual or small group may nevertheless entail unmanageable risk for a large group or inexperienced participants. However, if the Person in Authority is not sure as to the risk tolerance of the University or feels that allocation of additional resources or changes to university practices would allow the Activity Coordinator to manage the risk for the overall benefit of the university, that risk may be referred via their Responsible Executive to PEG for consideration within the ERM program. Step 7 Conduct activity in accordance with Risk Management Plan and the Activity Risk Management Policy Ensure all volunteers and, if the activity is not for academic credit, students sign the Informed Consent Record before commencing the activity. The extent of advance planning, preparation and approvals required prior to conducting an activity is commensurate with the level of risk associated with the activity and the experience of the participants. Repetition of an activity in the same or a similar locality may require a lower level of detail in the advance planning, but the level of detail needed in the briefing and 6

7 training should take into account the experience of the participants (e.g., by the nth running of a specific course or field trip, the hazards are likely to be well known and the Risk Management Plan well developed; nevertheless, the trip and its hazards are new to each successive group of student participants). Step 8 Post Activity Risk management is a dynamic process therefore Risk Management Plans must be continually reviewed and revised in consideration of the changing risk landscape. When reviewing feedback from participants, pay special attention to the effectiveness of the risk controls if a critical incident occurred. Consider changes in legislation, technology and the activity environment that may occur before the next time the activity is conducted. Related Policies / Procedures Activity Risk Management Policy and Procedure. Links Keywords activity, risk, control, sanctioned, safety, authority, hazard, critical, incident, plan Date Approved May 2009 Approval Authority Director, Risk Management 7