Assessing and Managing Asset Management Risks

What this module covers

Module 4 carries 10 questions. Its vocabulary is compact but tightly defined, and most of the marks go to getting the pairs and the sequence right.

Appetite and tolerance

Risk appetite is how much risk an organisation is willing to take in pursuit of its objectives. Risk tolerance is how much it is able to bear. The two can differ widely. An organisation with a large appetite and a small tolerance is heading for trouble. Appetite also isn't a single number, because organisations take different views of different kinds of risk. Without a stated appetite there is no consistent basis for deciding what to accept, and decisions end up depending on who happens to be making them.

The process, in order

Identify the risk, analyse it, evaluate it, treat it. Then monitor and review, because the picture keeps changing.

Analysis works out the level of risk by combining likelihood and consequence. Evaluation compares that level against criteria and appetite to decide whether it is acceptable and how urgently it needs attention. Getting these two the wrong way round is the most common ordering error.

Identification techniques are worth knowing by purpose. HAZOP works systematically through a process, applying guide words to find hazards and operability problems. FMEA works through failure modes and their effects. FMECA adds criticality, which turns the list into a ranking.

Treatment options

Four responses, often called the four Ts:

• Tolerate — accept the risk, with a recorded rationale
• Treat — reduce the likelihood or the consequence
• Transfer — share the financial consequence, typically through insurance or contract
• Terminate — stop the activity that creates the risk

Transfer moves the cost, not the accountability. The event still happens and the service is still disrupted. The same principle applies when work is contracted out: the activity moves to the contractor, but accountability stays with the organisation.

Criticality, residual risk and contingency

Criticality ranks assets by the consequence of their failure, so that effort can be prioritised consistently. It is not the same as condition. A sound valve that is the only feed to a hospital usually deserves more attention than a worn one on a lightly used branch. Residual risk is what remains after controls are in place, and it is what should be compared with appetite. Inherent risk is the exposure before controls.

A contingency is a possible future event that cannot be predicted with certainty, for which a response is prepared in advance. Plans need defined triggers, such as a critical asset failing or a quality measure crossing a threshold, so that invoking them is a decision rather than an argument.

Where marks are lost

• Swapping appetite and tolerance
• Putting evaluation before analysis
• Believing insurance or a contract transfers accountability
• Ranking assets by condition when the question is about criticality
• Treating a risk as eliminated and in no further need of review