Colour-coded risk management

The stages in the risk management process are similar to those in any other management system, often depicted as a number of stages in the form of a loop. A typical example is shown in Figure 1.

A key aspect of this cycle is measurement, and most organisations have developed some form of risk rating system, often in the form of a risk matrix, frequently based on a checklist formulated on the basis of a company's experience.

So far, so good. However, this is where problems often arise, the most obvious being the quality of the assessment. Most companies will have access to the perils within their own industry but may have limited knowledge of the potential pitfalls in other areas, for example, computer systems. As a consequence, the risks are underestimated. The example of computers will be familiar to most people, with well documented failures from government projects downwards.

It is therefore vital to ensure that the assessment methodology is broadly based and adequate for the purpose. Companies relying on insurance assessments may suffer, as these assessments are generally based on exposure to insured perils and will not consider risks that the insurance underwriter does not cover.

A second problem, often not considered, is the usability of the information. A risk matrix can be like a bikini – showing what is desirable, while hiding what is essential. As information is passed up the management tree, it becomes increasingly condensed – possibly to the point where senior managers and directors are unaware of situations at production sites or along the supply chain. This type of situation was highlighted in the recent Baker Report into the fire at the Texas City Refinery.

In summary, a simple industry-based assessment system would be a useful, transparent tool capable of providing adequate and concise information to senior management. While this is an easy comment to make, it is surprising how few useful tools are readily available. Many insurance brokers have some form of assessment system, usually of the 'black box' type, but it is not easy to see how the results are derived. Underwriters also have their own systems, but generally choose not to make these publicly available. In our experience, the majority of insureds rely on insurance reports but, increasingly, they are taking an independent approach and looking for additional risk management tools.

KRRIS (the Key Risk Ranking Indicator System) is designed to be a simple tool and to provide a consistent level of information to insureds, brokers and underwriters. This is a spreadsheet-based approach with basic versions available for free download from the internet (www.krris.com ). More complex versions are also available, providing a greater level of analysis.

The catalyst for the development of KRRIS was the requirement for a simple method for quantification of risk as part of insurance risk surveys. It quickly became clear that, to be of value, the output would need to be more than a single bland parameter, percentage or descriptive word or phrase.

“It is vital to ensure that the assessment methodology is broadly based and adequate

KRRIS consists of a relatively standard assessment based on key parameters, ranging from natural perils, fire loading, technology, management, operations, maintenance, to fire detection and protection.

The unique feature of KRRIS is that it summarises the risk information on a single A4 sheet, indicating the quality of the key aspects of the risk, plus (in the full versions of the spreadsheet) further information such as identification of the weakest features. The information is colour coded to aid understanding.

The original version was developed for use in the oil, gas and petrochemical industries, but other versions cover a variety of industries: offshore oil and gas, power stations, mining, construction and general industrial premises. Originally, KRRIS was seen purely as a simple risk assessment tool to accompany insurance surveys, but the extent of interest has been surprising and has led to it being used in a number of other ways:

n Bespoke versions of KRRIS have been developed for clients involved in particular activities. While the basic framework has been maintained, experts in the industry concerned are employed to ensure an adequate level of detail in the assessment. This approach makes KRRIS particularly suitable for organisations with multiple premises such as retailers and food chains. Typically, several locations could be visited in a day or, if suitably automated, location managers could complete the assessment for inclusion on a company-wide database. This would identify not only issues affecting a single site but also systemic weaknesses within an organisation, requiring action at a corporate level.

n KRRIS has been used as a benchmarking tool within some organisations, as described above. This has allowed management to target resources at the lower scoring areas at individual locations and, where appropriate, involve corporate management in the development of company-wide procedures and standards.

A new, potentially exciting use for KRRIS is as a tool in the major hazard industries for the development of 'leading indicators' to identify the onset of conditions which could lead to a major accident. The UK Health and Safety Executive is leading developments in this field, and KRRIS could readily be customised to act as a hazard warning indicator.

Overall, KRRIS is proving a very adaptable tool for basic risk assessment, both for insureds and the insurance industry. It is flexible and easily adapted to new uses, while still maintaining a distinctive output giving detailed information in a comprehensive and consistent manner.