Control Risks

If measures to control risks or protect new opportunities are not taken, threats that have thought to be mitigated may once again occur and opportunities that have led to improvements may degrade. Mechanisms to stabilize processes and hold gains made are necessary; while there are many other forms of control mechanisms, these eight provide a solid starting point.

• Embrace Standard Work
• Update Control Plans
• (Revisit) Training
• Conduct Internal Audits
• Use GR&Rs (Gage Repeatability & Reproducibility Studies)
• Deploy TPM (Total Predictive Maintenance)
• Track First Time Quality
• Evaluate Customer Satisfaction

Mitigation or Capitalization

Once risk potentials have been identified, analyzed and evaluated, action can be planned and taken to mitigate threats that constitute unreasonable risks as well as to capitalize on the opportunities that warrant action.

Approaches to Mitigate Threats

• Risk Elimination: Prevent the potential of risk.
• Risk Reduction: Minimize the impact or lower the likelihood of risk.
• Risk Avoidance: Stop or curtail the planned activity to avoid risk.
• Risk Assignment: Share (or transfer) the risk by outsourcing or insuring the activity.
• Risk Acceptance: Don’t mitigate the risk, accept it.

(While we list five options, only Elimination and Reduction can be considered true mitigation options. While avoidance may seem like a “safe” option, ending the related activity is often not a viable option.  And assignment or acceptance options impart a false sense of risk mitigation unless the potential risks are low. This course focuses on Risk Elimination and Risk Reduction, not the other three options.)

Approaches to Capitalize on Opportunities

Most opportunities will be customer-focused. “Categories” of opportunities include:

• Optimize products/processes: Can the product/process be made more robust?
• Revamp underperforming assets: Have customer needs changed?
• Enter new markets: Is there an opening for existing products/processes in new markets?
• Introduce new products: Is there a market opening for a new product/process or a product line extension?

Evaluate and Prioritize Risks

Use the Likelihood and Impact ratings in the Evaluate and Prioritize phase.  Categorize risks into broad High, Moderate and Low threat or opportunity categories.

• All High-Risk Indexes should be slated for an action plan.
• Low Risk Index scenarios don’t warrant action; the potential threat represents an acceptable risk, or the opportunity does not have an adequate return for the time and effort required.

Generally, additional factors should be explored to determine if Moderate Risk Index scenarios should be acted upon.

Moderate Threat Risks:

While the disposition of “High” and “Low” Risk Indexes is fairly straight-forward, dealing with Moderate Risks is not. To determine if moderate downside risks should be mitigated, consider the impact level.

• If the Impact of the risk receives a rating of “5,” that risk should probably be considered for action even if the Likelihood is low.
• However, if the impact rating is less than 5 for a threat potential and strong detection controls are in place, mitigation of that specific risk is often not needed. But if detection controls do not exist, it is probably worth considering mitigation solutions as long as they are practical and feasible.
• Before spending time developing a comprehensive action plan, assess whether the potential threat mitigation solution is practical and feasible. It is practical if it “makes sense” and feasible if it fits within the skill-set and resources of the organization.
• If a potential solution is not both practical and feasible, it doesn’t make sense to invest time and resources on it.

Moderate Opportunity Risks:

• Conduct a form of cost-benefit analysis to help determine if the potential opportunity is “worth” the time and resources to take action.
• If the cost to tackle an opportunity is high and the consequence of not acting on the opportunity is low, it makes sense to pass up that opportunity

Analyze Risk

Analyzing the potential risk (whether a threat or an opportunity) involves assessing both the Likelihood of Occurrence and the Potential Impact.

• Rate both the Likelihood and the Impact on a relative numerical scale.
• The greater the likelihood and more severe the impact, the higher the rating.

Identify

Potential Threats

When identifying threat potentials, it is helpful to use categories. Consider using these four categories for potential threats:

• Inherent process risks
• Risks caused by technological disruptions
• Risks linked to extreme events of nature
• Risks from willful or intentional misconduct

Examples of tools that are helpful in identifying threats after an event include:

• Monitoring escapes
• Warranty claims
• Process breakdowns
• Safety incidents
• Spills or emissions

However, being proactive and acting before a potential threat occurs can prevent if from occurring. Some tools and techniques for identifying threats before they occur are:

• Failure Mode and Effects Analysis
• Fault Tree Analysis
• Control Charts

Opportunities

Opportunities can be categorized as well:

• Optimize products/processes
• Revamp underperforming assets
• Enter new markets
• Introduce new products

Identifying opportunities usually involves listening to customers and better understanding the marketplace. Listening to customers helps to:

• Anticipate customer’s future needs.
• Question fundamental restrictions to our current product and processes.
• Anticipate proactive (or defensive) actions of our competitors.

When identified, opportunities help us look at the business in a different light often helping us recognize an opening for a unique product feature or market segment. Techniques that can help identify opportunities include:

• SWOT Analysis
• SOAR Analysis

Opportunities tend to proactively “stretch” the organization.

• Risk Elimination: Prevent the potential of risk.
• Risk Reduction: Minimize the impact or lower the likelihood of risk.
• Risk Avoidance: Stop or curtail the planned activity to avoid risk.
• Risk Assignment: Share (or transfer) the risk by outsourcing or insuring the activity.
• Risk Acceptance: Don’t mitigate the risk, accept it.

(While we list five options, only Elimination and Reduction can be considered true mitigation options. While avoidance may seem like a “safe” option, ending the related activity is often not a viable option.  And assignment or acceptance options impart a false sense of risk mitigation unless the potential risks are low. This course focuses on Risk Elimination and Risk Reduction, not the other three options.)

Approaches to Capitalize on Opportunities

Most opportunities will be customer-focused. “Categories” of opportunities include:

• Optimize products/processes: Can the product/process be made more robust?
• Revamp underperforming assets: Have customer needs changed?
• Enter new markets: Is there an opening for existing products/processes in new markets?
• Introduce new products: Is there a market opening for a new product/process or a product line extension?

Here is an example of a Risk-Based Thinking Summary Worksheet.

Identify

• Use a Reference Number to help keep track of risks.
• The Description summarizes the risk potential.
• The Type is either a Threat or OPPORTUNITY.
• The Source is either BEFORE a risk occurs or AFTER it happens.

Analyze

• The greater the likelihood and more severe the impact, the higher the rating.
• The likelihood is often rated on either an event-based scale or a time-based scale.
• The greatest impact may be on quality, finances, safety or the environmental.

Evaluate & Prioritize

• Calculate the relative RISK INDEX by multiplying the likelihood rating times the impact
• A RISK INDEX can have a range from a high of 25 to a low of 1. Generally, the higher the RISK INDEX, the greater the potential threat or opportunity.
• Prioritize risks as a high, moderate or low
• Evaluate whether the potential solutions considered for mitigating threats are practical & feasible or cost-effective for opportunities.

Mitigate or Capitalize

• Consider elimination and reduction approaches for threats such as Inherent Process Events, Natural Hazards and Technological Events and Willful or Intentional Misconduct.
• Potential paths for projects to tackle opportunities include optimizing products/processes, revamping underperforming assets, entering new markets and introducing new products.

Control

• Use “Control Mechanisms” to make sure measures are in place that track performance to ensure improvements made continue to work as expected.