Treating risk in your organisation

THE TAKEAWAY: Deciding how to treat each risk you have identified will involve performing a balancing act between risk versus benefit and risk versus cost and convenience.

This is the sixth step in a seven-stage process of successfully tackling risk management in your organisation (go to the Insurance and Risk Management Help Centre for information about the other steps.

Treating risks involves making a decision about what will be done about the risks faced by your organisation. By following the first five steps, you should now know what risks you face and how they could impact on your organisation, as well as having a list of priorities - you need to treat the highest risks first.

Treatment should be appropriate to the level of identified risk and generally any cost of treatment should be commensurate with the potential benefits.

If you have decided a risk is unacceptable, there are several options for treating it. Deciding which is most appropriate could be the job of your risk management sub-committee or a designated risk manager, or of your board/committee as a whole. These are important decisions and weighing them all up may take a while. It shouldn't rushed (but it shouldn't be put off, either).

Taking a methodical approach

An accident is the product of a chain of factors. Consider someone slipping on a wet floor. The accident is the slip. The outcome is the injury. The severity of the injury will be determined by a host of factors, including the age, size, fitness and clothing of the person involved, where and how they land and what they land on, and how long it takes to get medical attention.

In order to decide on a treatment for each risk, you need to pull them apart. There are a range of factors that contributed to the accident outlined above:

• the area had to be accessible
• the person had to be walking over that area at that time
• the floor had to be wet in the area at that time
• the floor had to be a type that becomes more slippery when wet.

If just one of these factors was removed, the accident may not have happened.

You need to think about what actions you can take to avoid the factors contributing to each risk you have identified. For example:

• If the person wasn't there, the accident wouldn't have happened
  Put up a warning sign, rope off areas that are wet

• If the floor didn't become slippery when it was wet, the accident wouldn't have happened
  Choose floor and cleaning products that prevent the surface becoming slippery

The task of actually treating the risks will involve everyone - perhaps you could stage a clean-up day at your premises where dangerous items are moved or replaced and everybody tackles jobs to make the place as safe as possible.

Following this initial blitz, it will probably be necessary to assign specific tasks to individuals - for example, in the treatment of vehicle-related risks, you might ask one of your regular drivers if she can get a roadworthy check on the club bus; if the risk is related to serving of food, you might assign a committee member to contact your state government about food handling regulations.

Remember to have a system in place to monitor what everybody is doing, through reporting or perhaps by holding regular meetings where they can report their progress.

Put your risk management sub-committee or manager in charge of assigning tasks and keeping informed of the progress of each one, and then reporting back to the board. Good and constant communication is essential because some actions will take longer than others and different tasks will involve different people. For example, the treasurer will have to approve spending to buy a new heater to replace the one throwing out sparks, or to fix the tiles on the roof of the clubrooms.

So how do you decide the best way to treat a particular risk? Well, it's a balancing act:

• The balance between risk and benefit
  It is very hard indeed to remove every single risk that applies to your organisation. In each case, you're going to have to weigh up the risks with the benefits. For example, you may be able to avoid the risk of child abuse by dropping all of your services that involve children, but that might remove the purpose for your organisation existing in the first place. The implementation of police checks for all staff or requiring and checking references may diminish the risk substantially.
• The balance between risk and cost or convenience
  You need to ensure that the costs of mitigating the risk don't exceed your organisation's ability to pay. For example, you may be able to reduce the risk of someone falling down stairs by moving to a new building, but that could divert all your funds away from more important work. Putting up handrails, warning signs and non-slip strips may lessen the risk.

Remember that your liability if something goes wrong is going to be affected by whether or not people think that you've done all you reasonably could to avoid it.

Courts do, however, take into account what is reasonable and practicable for an organisation to implement. Not putting up a sign to warn people of a slippery surface because it costs $10 is a lot different from having to resurface an entire premises at a cost of $20,000. The context of the organisation would be taken into account if, for example, your annual budget is only $1000.

As with all of the steps in risk management, it's important to document your decisions and the reasons you made them.

There are a number of options for treating risk - these are outlined below. Remember to tackle the highest priority areas first.

Avoiding the risk

The best thing you can do is eliminate the risk completely. Fix what you can fix. This could mean removing trip hazards on the floor in the corridor, disposing of dangerous items or changing the way your group operates so a potential risk is avoided altogether.

Reducing the risk

Look at alternative solutions that reduce risk. Initially focus on "industrial" solutions that do not require people to change their behaviour, such as improved lighting, safety barriers and resurfacing.

Solutions such as new rules, policies or training can then be looked at to further reduce risk.

Other options, such as protective equipment, can also assist.

Risk reduction strategies can reduce the frequency or severity of the losses resulting from a risk, usually by changing operations to reduce the likelihood of a risk, reducing the resulting damage if the risk does occur, or both.

Often a combination of risk reduction solutions will be needed. For example, the chances of a hockey player having her teeth knocked out by the ball can be reduced by playing on a synthetic surface that provides more consistent bounce, enforcing rules that restrict lifting the ball, and by the player wearing a mouthguard.

Follow this process to help you decide what needs to be done:

1. Substitution
   Replace something that is hazardous with something less hazardous. Change the bald tyres on your club's bus, replace that 40-year-old heater, get a new rug with non slip backing.
2. Engineering
   Apply an engineering solution to minimise risk. For example, move a bench so dangerous items are out of risk of children, put up warning signs, improve lighting in the car park, or put carpet on a slippery floor.
3. Isolation
   Isolate the risk so it applies to fewer people, less often. Put any dangerous substances where only people who need them, and know how to use them safely, will have access, or use an enclosed spray booth for spray painting.
4. Administrative
   Apply administrative measures that can reduce risk, such as implementing safe work procedures, policies or rules, rotating staff or training volunteers.
5. Personal protective equipment
   As a last resort, provide a personal barrier to the risk, such as gloves, helmets, goggles, etc.

General precautions

Your organisation can take a number of general safety precautions and contingency measures to reduce the risk of an accident, or minimise the losses if something goes wrong. These include:

• Carrying out inspections at the end of each day, or after your activity is finished, to ensure all electrical appliances are turned off, doors and windows are locked and everything is where it should be
• Making a list of key contact numbers in case of emergency - and keep it handy
• Keeping a list of contact numbers for staff/volunteers/members/clients in case of emergency
• Keeping vital information stored on computer on back-up disks off the premises
• Keeping up to date with general maintenance, such as cleaning out gutters, downpipes and drains each summer
• Familiarising your staff/volunteers with the location of the mains service isolation switches and valves for electricity, gas and water

See the help sheet titled Ten steps to a safer organisation for more tips.

Screening

The best way of reducing, and hopefully avoiding, the risk of harm to your clients and organisation caused by staff or volunteers (child abuse is the most feared example but staff can cause other problems, from giving bad advice to pocketing raffle money) is to ensure you have staff or volunteers who aren't going to do the wrong thing.

This can be achieved, at least in part, by screening. Screening, for many people, conjures images of draconian police checks and intrusively delving through people's personal details. But screening is a sensible process that is designed to find out if a prospective employee or volunteer is suited to your organisation. It's better to find out now than wait until something goes wrong before discovering a volunteer or staff member could have been seen to be a potential danger.

Most people do not object to screening (even police checks). Most people understand why it's important (and in some cases it may even be required by law).

Screening usually involves five steps:

• The position description
• Advertisement
• Application form
• Interview (and check of references)
• Police records check - if appropriate

For more information on screening is available in this help sheet.

Transferring the risk

If you're not able to remove or substantially reduce the risk - and some activities (skydiving, whitewater rafting, living) are inherently risky - you may be able to shift the burden of the risk on to someone else's shoulders.

Some means of transferring risk are outlined below.

Enlisting help

You may be able to shift your risk, or at least share it, by hiring subcontractors or sharing the job with another organisation.

Organisations with a speciality in a certain area will usually have their own forms of risk management (though do make sure it's clear who's covering what).

Waivers

Another way of transferring risk is to ask people to sign a waiver before they undertake activities with your organisation.

However, it's important to realise that waivers are not an excuse or protection for people or organisations that act in a negligent manner. And a waiver does not relieve your organisation from its duty of care to whoever signs it.

A waiver is valid only if all the possible foreseeable risks have been fully explained and that everything has been reasonably done to eliminate, minimise or control the risk.

This area is a legal minefield in itself and waivers tend not to hold much credence in courts. Don't rely on them to prevent your organisation from being sued.

Having said that, it is worth noting that it does tend to make people think twice about suing if they have signed something saying that they were aware that they were participating in a risky activity and that they had been made aware of all the possible risks that activity could possibly entail.

Disclaimers

Like waivers, disclaimers - statements about what you're accepting responsibility or not accepting responsibility for - also do not excuse you from your duty of care.

Putting up a sign saying that you're not liable for people slipping on the rug is not a protection if you have acknowledged that the rug is dangerous, have had numerous complaints and still not done anything to remove the danger.

Insurance

Unfortunately, a risk management program cannot create 100% protection from risk - it is a tool to reduce and manage risks, not eliminate them.

Insurance is the most common method of risk transfer. It is essential that your organisation has relevant insurance policies to protect people within your sphere of control.

There are a range of insurance options available to not-for-profit organisations. You need to ensure you assess each option to make sure you have the right type and level of coverage.

This help sheet will help step you through your options.

Managing risk

While your risk management program aims to reduce the chance of accidents happening, there will be times when things do go wrong. It's important you have procedures in place to deal with emergencies if they arise.

Ask these questions:

• Do you have a first-aid kit? Is it maintained? Do people know where it is and how to use it?
• Are staff or volunteers trained in first-aid and emergency procedures?
• Do you have an evacuation plan? Do people know what it is? Do you practice it?
• Do you have contact numbers for emergency services handy?
• Do you have all of the policies and procedures you need and are people aware and observant of them?

You may not be able to prepare for every eventuality, but you will be able to deal with unforeseen emergencies much better if procedures are already in place - if you've planned for a flood and you get a fire, at least you will have an evacuation plan in place.

Remember, the extent of your liability is determined by whether you have done all you reasonably could in the circumstances.

Documentation

As with all steps in the risk management process, it is important you keep records of what decisions you have made about treating risks, what actions need to be performed, by whom, and what deadlines or criteria you have set for making sure they get done properly and on time.

You can use a risk register to help you keep track.

Treating risks in your organisation is the sixth step in a seven-stage process of successfully tackling risk management in your organisation. The seventh step is monitoring risk.