Category: system lifecycle

The Risk Question

The risk question established the purpose and scope – the context of the risk assessment. This step is critical since it sets the risk assessment’s direction, tone, and expectations.  From this risk question stems the risk team; the degree, extent, or rigor of the assessment; the risk assessment methodologies; the risk criteria; and levels of acceptable risk.

The risk problem needs to be clear, concise, and well understood by all stakeholders. Every successful risk assessment needs a tightly defined beginning and end, so the assessment team can set good boundaries for the assessment with internal (resources, knowledge, culture, values, etc) and external (technology, legal, regulatory, economy, perceptions of external stakeholders, etc) parameters in mind.

To ensure the risk team focuses on the correct elements, the risk question should clearly explain what is expected. For example:

  • For a risk assessment of potential emergencies/disasters, should the assessment be limited to emergencies/disasters at facility sites or include events off-site? Should it include natural, manmade, or technological emergencies/disasters, or all of them?
  • If the hazards associated with the job of repairing a porch as to be assessed, would it just cover the actual porch repair, or would it include hazards like setting up the space, bringing materials on site, and the hazards associated with use/not-use of the porch?
  • If the risk assessment covers getting a new family dog does it include just those associated with the dog, or does it include changes to the schedule or even next year’s vacation?

Setting the scope too narrow on the risk question might prevent a hazard and the resulting risk from being identified and assessed or making it too broad could prevent the risk assessment from getting to the real purpose.

Risk questions can be broken down in a tree structure to more define scopes, which can help drive effective teams.

For example, if we are doing a risk assessment on changing the family’s diet, it might look like this:

The current draft of ICH Q9 places a lot of importance on the risk question, rightfully so. As a tool it helps focus and define the risk assessment, producing better results.

Preliminary Hazard Analysis

The Preliminary Hazard Analysis (PHA) is a risk tool that is used during initial design and development, thus the name “preliminary”, to identify systematic hazards that affect the intended function of the design to provide an opportunity to modify requirements that will help avoid issues in the design.

Like a fair amount of tools used in risk, the PHA was created by the US Army. ANSI/ASSP Z.590.3 “Prevention through Design, Guidelines for Addressing Occupational Hazards and Risks in Design and Redesign Processes” makes this one of the eight risk assessment tools everyone should know.

Taking the time to perform a PHA early on in the design will speed up the design process and avoid costly mistakes. Any identified hazards that cannot be avoided or eliminated are then controlled so that the risk is reduced to an acceptable level.

PHAs can also be used to examine existing systems, prioritize risk levels and select those systems requiring further study. The use of a single PHA may also be appropriate for simple, less compelx systems.

Main steps of PHA

A. Identify Hazards

Like a Structured What-If, the Preliminary Hazard Analysis benefits from an established list of general categories:

  • by the source of risk: raw materials, environmental, equipment, usability and human factors, safety hazards, etc.
  • by consequence, aspects or dimensions of objectives or performance

Based on the established list, a preliminary hazard list is identified which lists the potential, significant hazards associated with a design. The purpose of the preliminary hazard list is to initially identify the most evident or worst-credible hazards that could occur in the system being designed. Such hazards may be inherent to the design or created by the interaction with other systems/environment/etc.

A team should be involved in collecting and reviewing.

B. Sequence of Events

Once the hazards are identified, the sequence of events that leads from each hazard to various hazardous situations is identified.

C. Hazardous Situation

For each sequence of events, we identify one or more hazardous situations.

D. Impact

For each hazardous situation, we identify one or more outcomes (or harms).

E. Severity and occurrence of the impact

Based on the identified outcomes/harms the severity is determined. An occurrence or probability is determined for each sequence of events that leads from the hazard to the hazardous situation to the outcome.

Based on severity and likelihood of occurrence a risk level is determined.

From hazard to a variety of harms

I tend to favor a 5×5 matrix for a PHA, though some use 3×3, and I’ve even seen 4×5.

Intended outcomes

Likelihood of Occurrence

Severity Rating

Impact to failure scale

1

Very unlikely

2

Likely

3

Possible

4

Likely

5

Very Likely

5

Complete failure

5

10

15

20

25

4

Maximum tolerable failure

4

8

12

16

20

3

Maximum anticipated failure

3

6

9

12

15

2

Minimum anticipated failure

2

4

6

8

10

1

Negligible

1

2

3

4

5

Very high risk: 15 or greater, High risk 9-14, Medium risk 5-8, Low risk 1-4

 

F. Risk Control Measures

Based on the risk level risk controls and developed and applied. These risk controls will help the design team create new requirements that will drive the design.

On-going risks should be evaluated for the risk register.

Competence

We can break down people’s abilities into four areas:

CapabilityWhat people need to do to produce results
SkillBroken into technical knowledge and practiced performance
InterestPassion
Required behaviorsOperationalize the organization’s vision, culture, or way of being in behavioral terms. 

Competence is a combination of Capability and Skill. If I do not have the capability for the work, no amount of developmental training will be helpful. And, I don’t have the skill, you will never see my capability. Competence is a combination of both.

Interest or passion for the work will influence the amount of time for practice. The more interested I am, the more time I will spend in practice. And if I don’t practice a skill, the skill goes away, and competence diminishes.

There is also a set of required behaviors. Practice arrives with many qualities, frequency of practice, duration of practice, depth of practice, and accuracy of practice. Accuracy of practice relates to required behaviors. Practice doesn’t make perfect, only perfect practice makes perfect.

Deliberate practice allows us to influence all four attributes.

Subject Matter Experts Role in Knowledge Management – a Competency Approach

A Subject Matter Experts (SME) is a fascinating creature, both those within an organization and those considered a SME outside their organization – for example by a professional society.

A SME is engaged in knowledge management activities, what we want is for those activities to be a explicit and systematic management of the processes of creating, gathering, validating, categorizing, archiving, disseminating, leveraging, and using knowledge – whether for improving the organization and the individuals in it or the broader profession.

The thing is, this is another skill set for most SMEs. There will be SMEs out there who can do this from practice, but we need to be more deliberate in providing the skills. To provide the skills we must understand what we need to teach, which is where a competency model is valuable.

For the purpose of this post I’ll use the same three levels the ASQ Human Development and Leadership technical community uses for their competency framework:

  • Basic: Possesses general, conceptual knowledge or awareness of this concept OR a limited ability to perform this skill. Needs reference materials to complete tasks related to this concept.
  • Intermediate: Able to apply knowledge of this concept in work OR can perform this skill consistently with minimal guidance.
  • Advanced:  Provides expert advice and make sound judgments using knowledge of this concept OR provides consultation and leadership to others using this skill. Can foster greater understanding of this concept among colleagues and stakeholders.
CompetencyLevel to build towards
Knowledge of principles of knowledge management, for example conceptualizing, managing, preserving, and/or maintaining organizational knowledge.Advanced
Knowledge of methods and techniques for capturing and codifying knowledge, for example storytelling, data mining, cognitive mapping, decision trees, and/or knowledge taxonomies.Advanced
Knowledge of methods and techniques for disseminating and/or sharing knowledge across individuals, groups, and organizations.Advanced
Skill in designing and implementing knowledge management strategy.Intermediate
Skill in identifying the quality, authenticity, accuracy, impartiality, and/or relevance of information from various sources, for example databases, print and online media, speeches and presentations, and observations.Advanced
Skill in organizing and synthesizing information from multiple sources, for example databases, print and online media, speeches and presentations, and observations.Advanced
Skill in curating instructional content, tools, and resources, for example researching, evaluating, selecting, and/or assembling publicly available online courseware.Basic
Skill in identifying the type and amount of information needed to support the development of others in the topic.Advanced
Skill in developing, managing, facilitating, and/or supporting knowledge networks and communities of practice. Advanced

We need to recognize that not every SME will get to this level, or have the time to consistently apply it. This is why it is important to have knowledge management experts to support, nurture and step in where needed to assist.

Enabling the Process Owner to Drive Improvement

The process owner is a central part of business process management yet is often the one we take for granted. In this session, the speaker will share through case study how organizations can build strong process owners and leverage them to drive improvement in a highly regulated environment. Participants in this session will learn: ~how to identify process owners and competencies for success, ~how to build a change management program that leverages process owners as the guiding coalition, and ~how to create and execute a training program for process owners

2022 ASQ WORLD CONFERENCE ON QUALITY & IMPROVEMENT

The presentation I gave at the 2022 World Conference on Quality & Improvement.