HSE risk assessment and safe job analysis (SJA)

HSE risk assessments

Risk assessments related to health, safety, and environment (HSE) are mandated by the Working Environment Act §3-1 and are considered part of the systematic work with HSE. There is also a requirement that the risk assessments, along with associated plans and measures, be documented in writing according to the Internal Control Regulations §5.

All units at UiB must assess their own work environment related to HSE in one or more HSE risk assessments. The HSE risk assessments must be updated annually, and this is reported annually in the HSE annual report.

Some units have higher risk levels and must therefore conduct several HSE risk assessments in connection with these activities (e.g., related to laboratories, clinics, fieldwork and expeditions, workshops, etc.). There are also additional requirements for risk assessments for certain types of work according to the regulations on Organization, Management, and Participation §7-3 and regulations concerning the Performance of Work, which are discussed in the next chapter.

It is the line manager's responsibility to ensure that HSE risk assessments are carried out at the unit. The line manager can delegate the task of conducting the assessments to the HSE coordinator or another employee, but cannot delegate the responsibility. The safety delegate has a supervisory role.

Briefly about ROS Analyses

ROS analyses (Risk and Vulnerability Analyses) are overarching risk assessments related to safety and emergency preparedness at the faculty/department level or higher. In this type of analysis, only events that can trigger emergency plans and have major unacceptable consequences for UiB's values: life/health, environment, operations, economy, or reputation, are considered.

The ROS analysis is used as a basis to identify and implement measures that reduce the risk of emergency events, develop/update emergency plans, and select exercise scenarios.

ROS analyses are something that most employees at UiB do not need to relate to, as these should only be carried out at a higher level by faculty management. ROS analysis is often mistakenly used as a term for HSE risk assessments, which can cause some confusion.

The image below provides a visual representation of the organization of risk assessment related to HSE and emergency preparedness at UiB.

Photo:

(c) UiB 2024

Other Risk Assessments

There are also risk assessments that cover other areas and use different methodologies than HSE (Health, Safety, and Environment) risk assessments. Therefore, these must be conducted as separate risk assessments. This applies to buildings and valuables (Property Department) and IT security (IT Department).

Some areas have additional requirements for risk assessments, and it is recommended that those who are to carry out risk assessments linked to these areas familiarize themselves with these additional requirements. Risk assessments shall be carried out in accordance with the Regulations concerning the Performance of Work, in connection with:

• the use and handling of chemicals
• hot work
• the risk of exposure to biological agents
• exposure to mutagenic agents
• exposure to noise and mechanical vibrations
• exposure to artificial optical radiation
• exposure to an electromagnetic field
• the performance of work at height
• the performance of excavation work
• manual work that can entail a risk of harmful strain
• work that may entail a risk of exposure to violence and threats of violence
• work under water or under increased ambient pressure
• the risk of avalanches

To map hazards and problems, the unit should:

• Review work tasks, activities and locations at the unit
• Review previous HSE nonconformities and risk assessments
• Talk to unit staff​
  • The employees are a very valuable source of information about what is hazardous in everyday work
• Map the organizational and psychosocial work environment with an Local working environment survey (previously known as HSE meeting) annually, this can be replaced by Joint working environment survey (previously known as ARK) in the years that this is carried out
• Map the physical working environment with the Safety Round (previously known as HSE round)

Based on the mapping, it is possible to pinpoint the potential risks associated with the units activities. This then dictates what should be incorporated into the HSE risk assessment(s).

The HSE risk assessment consists of asking a number of questions:

• What could go wrong?​
  • Identify hazards and undesired events
    • An example of an undesired event could be a chemical splash into the eye.
• Why could it go wrong?
  • What are the causes of the undesired event?​
    • In the example of chemical splash into the eye, the causes could be, among other things, that one did not wear safety glasses, or that the safety glasses did not cover well enough.
• How likely is it to go wrong?
  • Is often expressed in terms of frequency (how often)
    • This depends on the level of activity and the existing routines at the unit, but we can e.g. say this happens between once every year and once every 5 years.
• What can happen if it goes wrong?​
  • Consequences for values such as "life and health", "operation, production and service"
    • The consequence for "life and health" can be anything from minor eye damage to permanent eye damage. It can also affect operations if a key person need sick leave.
• What can we do to prevent things from going wrong?​
  • This is called preventive measures ​
    • For example wearing tight fitting safety glasses and work in fume hood.
• What can we do to mitigate the consequences if things go wrong?​
  • This is called mitigating measures​
    • For example have eyewash available in the laboratory. Have routines for going to the emergency room. 

At UiB, we have prepared templates for HSE risk assessments (see Factbox) that can be used in the work with the HSE risk assessment. These are based on templates from the Norwegian Labor Inspection Authority.

We use probability as a measure of how likely we think it is that an (undesired) event will occur, based on the knowledge we have available.

Consequence is a possible result of an undesired event, and can involve the loss of or damage to values we want to protect. At UiB, these values are "life and health", "environment", "operation, production and service", "economic and material values", "credibility and reputation".

Risk can be presented in a risk matrix, with consequence along one axis and probability along the other axis. This gives a picture of the risk in two dimensions, probability and consequence. The matrix can have different sizes, but 5x5 cells are common.

To place probability and consequence in the matrix, criteria for probability and degree of consequence are used.

The probability is divided into numbers from 1-5, where each number represents a specified probability. For example the number 3 means "Likely" which indicates that the event could occur "Between once every year and once every 5 years". These are assessments made during the risk assessment based on the knowledge you have about a potential undesired event.

The table below shows the criteria for probability:

The degree of consequence is divided into letters A-E, where each letter represents one degree of consequence. For example the letter B represents a specified degree of consequence; "A certain hazard".

The degree of consequence will have different meanings for the various values "life and health", "environment", "operation, production and service", "economic and material values", "credibility and reputation".

For the value "life and health", "B. A certain hazard" means: "Few or minor physical or mental injuries.", while for the value "operation, production and service", "B. A certain hazard" means: "Minor reduction of primary functions that can be solved by simple means within a short time." There is an overview of this in the criteria for probability and consequence.

The numbers for probability (1-5) and the letters (A-E) for the degrees of consequence are used to find the placement of the undesired event in the risk matrix.

In order not to have to use 5 different risk matrices, one for each of the values "life and health", "environment", "operation, production and service", "economic and material values", "credibility and reputation". The value with the highest risk for the undesired event is what is presented in the matrix in the template.

The risk is higher, the further up and to the right the event is placed in the matrix. The risk matrix is divided into the colors red, yellow and green to convey the level of risk:

• Red is not acceptable and risk reducing measures must be taken immediately.
• Yellow indicates the need for the introduction of risk-reducing measures.
• Green indicates acceptable risk. The introduction of measures should be considered if the effects will obviously be good.

Photo:

(c) UiB 2023

The risk matrix provides a visual representation of risk that is very simplified, in addition, the risk matrix does not say anything about the uncertainty or degree of knowledge behind the assessments. The risk matrix is still a good aid as long as one is aware of the weaknesses associated with it.

Measures are all remedies that can be implemented to reduce the risk associated with an undesired event. 

Preventive measures:

Reduce the probability/likelihood of the undesired event from happening​. Also called probability-reducing measures.

• An example of a preventive measure is to wear a reflective vest when cycling in the dark. Increased visibility reduces the likelihood of being hit by a car.

Mitigating measures:

Reduce the consequence of the undesired event if/when it happens.​ Also called consequence-reducing measures.

• An example of a mitigating measure is the use of a bicycle helmet, since it will be able to reduce the consequence (damage to life and health) should you have an accident.

How do you carry out a risk assessment? This depends on the scope of the risk assessment. Some do risk assessments alone because they only risk assess their own work. But more overall risk assessments should be carried out in a group to ensure proper involvement. Below follows a description of how to carry out a risk assessment with several participants, but the description is also transferable if you carry out a risk assessment for your own work.

Planning

Good planning in connection with the risk assessment will make the job easier and improve the quality of the analysis.

Some things that should be thought through before carrying out a risk assessment are:

• Why are you doing a risk assessment?
• What are you doing a risk assesment of?
  • The mapping will provide a basis for assessing what should be risk assessed.
• What are you not including in the risk assessment?
  • It may be a good idea to limit the scope of the risk assessment so that it does not become too large. Rather, divide into several smaller ones.
• Who should be involved in the risk assessment?
  • In the sub-chapter below on Participants, you can read more about who should join.
• Obtain information
  • E.g. look at previous HSE non-conformities and risk assessments, carry out inspections, talk to staff/colleagues.

Participants

Risk assessments shall be carried out in collaboration with the employees and their representatives.

One way to carry out the HSE risk assessment is by having a workshop meeting with relevant participants.

It is recommended to have 3-6 participants in the analysis:​

• ​Line leader or it's representative (is usually the one who arranges the risk analysis)​
• Employees with knowledge of what you are risk assessing
• People with knowledge/education in the field/area
• Employees who are affected shall be given the opportunity to participate
• Safety delegates may participate where appropriate, but should be informed of all risk assessments performed at the unit

Workshop meeting

1. Begin by agreeing on what should be included in the risk assessment.
   • People can often have different opinions, so it's a good idea to start with a clarification of expectations to avoid talking past each other.
   • In some cases, it may be worthwhile to divide the risk assessment into several risk assessments, if the scope becomes too wide.
2. When you agree on what should be included in the risk assessment, you can start by identifying undesired events. For example an undesired event could be a chemical splash in the eye as in the example above.
   • One way to give everyone the opportunity to provide input is to start with 5-10 minutes where everyone individually notes down undesired events that they think may occur on post-it notes. One event per post-it note.
   • Then everyone sticks their notes on a board or wall, and you can collect and merge the undesired events that are similar.
   • If there are a lot of different undesired events, and you don't have the opportunity to analyze each event in detail, you can select the ones you consider most important and proceed with them.
3. Note the undesired events you want to proceed with into the HSE risk assessment template.
4. For each individual event:
   • Discuss what might cause the undesired event.
   • Identify consequences. One undesired event could have several consequences, note everyone.
   • Identify existing risk reducing measures (preventive and mitigating).
   • Specify the probability that the event may occur, using the criteria.
   • Specify the degree of consequence the event will have on our various values using the criteria.
   • Find the position in the risk matrix using numbers for probability and letters for consequence (in the Excel template this happens automatically).
   • How do we assess the risk based on what we have analyzed so far? Is there a need for new measures to reduce the risk?
     • Identify new measures, then specify probability and degree of concequence again.

Follow-up

You can use the action list to follow up and implement the measures, the action list is part of the risk assessment template.

More long-term measures can be included in the HSE action plan.

It is the line manager's responsibility to ensure that the risk assessments are followed up afterwards and that measures are introduced.

Safe job analysis (SJA) can be used as a supplement for a single work task or activitiy where HSE risk assessments or established routines/procedures do not cover the work that is to be carried out. Anyone can do an SJA, but whoever is going to do the actual work task or activity must participate in the SJA.

You can find the template for SJA in the fact box.

Implementation

1. Divide the work task/activity into sub-tasks.
   • The sub-tasks must be in the order in which they would naturally be carried out.
2. Identify undesired events that may occur related to each sub-task.
3. Identify measures for the undesirable events associated with each sub-task to reduce the risk.

Below is a very simplified example of an SJA.

After completion of the SJA and if measures have been introduced so that the task/activity can be carried out in a safe manner, the work can be started.

An SJA can, for example, be carried out if you are to carry out risky work and:

• If the task / activity deviates from established routines or procedures.​
• If the work requires collaboration between different units or professional groups.​
• If the equipment you are going to use is not covered by current work instructions or routines.​
• If the people who are working on the task do not have experience with this task / activity.​
• ​If there has been undesired events in connection with this type of work in the past.