How Can I Defend Our Risk Assessment Method Against Auditor's Non-Conformance?

Dear HSE Professionals,

Please help me solve this problem. In our industry (Steel Pipe Manufacturing), to fulfill the requirement of the OHSAS-18001 standard, we are maintaining a Risk Assessment register.

Risk Assessment Methodology

Our risk assessment methodology is as follows: The overall OH&S hazards shall be calculated by the formula:

- Scale – A: Probability of Occurrences
- Scale – B: Severity of the Consequences

Risk = Probability of Occurrences (A) + Severity of the Consequences (B)

- Maximum Possible Value shall be = 10
- Minimum Possible Value shall be = 02

A 5 + 5 risk matrix shall be taken into consideration for the Final Risk Value.

Recently, one of the external auditors raised a Non-Conformance (NC) against this risk assessment method. He stated that this method is not acceptable and is wrong. Now, I want to prove that this method is not wrong. I need some supporting data. Please suggest.

With Regards,
Rohan Puthran.

There is no word like "tolerable" and "untolerable" in OHSAS 18001:2007. Please use the words "Acceptable" and "Unacceptable." Cost or money should not be considered when evaluating health and safety issues. Your risk of consequence should be as follows:

Slightly Harmful: Momentary discomfort.

Harmful: Minor injuries (non-reportable) requiring first aid.

Very Harmful: Major injuries, absence from work is less than or equal to 48 hours, or temporary disability.

Extremely Harmful: Injuries resulting in absence from work for more than 48 hours, fetal/permanent disability, major incidents involving a large number of people.

Also, consideration should be given to legal concerns, domino concerns, and chronic effects regardless of the score. The risk rating should be the likelihood of occurrence multiplied by the risk of consequence. I believe this would provide a clear understanding.

With lots of regards,

Hasmukh P. Valand

The standard does not provide any prescribed method to evaluate hazard identification. However, the requirements under 4.3.1 must be complied with, such as routine, non-routine, direct or indirect, legal requirements, behavioral acts, etc. The procedure might not have been explained well to the auditor; hence, this issue might have arisen. Please provide a correct explanation in the corrective action report. Your Level two procedure must be clear on this aspect.

Regards,
T.S. SRINIVASAN

Can you please explain to me why Risk = Probability of Occurrences + Severity of the Consequences is considered wrong (not acceptable)? The auditor's opinion is that it should be expressed as Risk = Probability of Occurrences x Severity of the Consequences. Why is that the case?

With Regards,
Rohan P

Here is a matrix I am providing you to rate the risk. This will help you better as human behavior is also considered in risk assessment.

Regards, Anurag

Dear Rohanputhran,

There are quite a few open ends. Let me try to address those points so that you can find a solution to your problem.

Whenever any Non-Conformance (NC) is raised, the Auditor would clearly specify why it is a Non-Conformance. That is, they would specify the nature of non-compliance. The details of the NC have not been provided by you, but we can still try to find a solution.

Failure Mode Effect Analysis (FMEA) and RPN Concepts

RPN stands for Risk Priority Number. It takes into account the SEVERITY, CHANCES OF OCCURRENCE, and CHANCES OF DETECTION. The RPN is a multiplier of all the above three, by definition. My guess for the multiplication is to project the compounding effect of all three. I am open to other views on this.

In your case, you have not made any reference to DETECTION at all. Did the auditor point this out? You mentioned that the auditor has asked you to multiply the other two. According to me, all three have to be first identified and then multiplied. As you may be aware, all three are mutually independent.

Further, in Risk Assessment studies, on the score of SEVERITY rating alone, certain tasks (?) can be categorized. Plenty of study material is available on the internet, providing more details and explanations. Perhaps on Cite HR also—I have not tried it.

If you can provide a process description and how the risk analysis has been done, more contributions might flow. However, the best solution is to delve into the theoretical aspects and then apply them to your Steel Pipe manufacturing process.

Regards,
V. Raghunathan
Navi Mumbai

Mr. Raghunathan is absolutely correct. Nobody can issue a Non-Conformance (NC) if the method of multiplication has been utilized. Each organization is entitled to establish its own procedure and must adhere to it. Multiplication is merely a numerical manipulation to exhibit greater concern.

It is advisable to refer to the standard for its specific requirements rather than solely meeting the auditor's expectations. Typically, auditors will request compliance based on their interpretation of the standard.

I am available to offer guidance if you are involved in the chemical manufacturing process.

Best regards,
Hasmukh P Valand

You defended your risk calculation with your auditor. Using addition (+) is a very good initiative and an improvement from your side. As Mr. Srinivasan mentioned, the standard does not prescribe a specific method for hazard identification evaluation. However, risks should be classified as acceptable and unacceptable, as per the Factories Act.

For severity, use the terminology: Trivial, Moderate, and Critical. For probability, use the terminology: Remote, Likely, and Certain. It would be beneficial to mention the cutoff score and include the legal requirements in your HIRA register.

An auditor can raise a non-conformance if you fail to cover all your organization's activities and your risk identification is improper, not necessarily about the matrix. If he provides any suggestions and improvements, you can consider them.

Regards,
Narayan
Lead Auditor for QMS & HSE