The third dimension of risk - Resilience

I was sitting with a friend last week and we were talking about decision making in leaders and the consequences of poor 'calls'. I work in the Hazardous Industries sector so have loads of unfortunate examples but we talked about Beirut, 2,750 tonnes of ammonium nitrate detonating and killing 220 people, injuring 7,000 and making 300,000 people homeless. The explosion was recorded as a seismic event of magnitude 3.3. The Lebanese cabinet has resigned on mass and the port officials are under house arrest awaiting investigations.

I related this incident to research on behalf of 'Step Change in Safety' that myself and the competence worgroup are doing on leadership competence, the challenge is, 

"We have numerous courses in managerial skills from supervisors through managers and onto leaders and we (the energy industry) still keep killing employees- why?" 

I went on roughly as follows. "Established 'risk management' work that is available seems logical and robust and appear in a seamless continuum from site safety talks through, to Hazard Studies, Quantitative Risk Assessments and a plethora of methods, audits and practices. There are numerous academic papers on cumulative risk concepts, risk appetite and human factors." 

We then talked about following process. "Given a set of inputs and parameters there is the range of solutions. So, in theory we shouldn't be killing people" the laws of probability apply and things do break. However, multiple simultaneous failures should not occur at the frequency they appear to. 

Using classical two dimensional risk management in the recent Beirut example, 

1. Consequences – The mass of ammonium nitrate along with it rate and explosion profile was known (1.2 kilo tonnes of TNT) . Even if modelling was not done or they could not afford complex sums a simple comparison with other events would have given an approximate damage zone. 
2. Probability - The storage was rather poor and left for 6 years degrading so the probability of an ignition source was rather high and getting 'higher' 

This would have given a red flag and indeed letters from the Beirut port authority were sent in 2014, 15,16 and 17. In 2016 a letter stated the port was at risk and also noted failures to respond to previous letters. In short nothing was done. What is missing from a two dimensional method is the third dimension of 'Resilience'. 

My friend responded, "what you have just described is exactly what I have been going through over the past month. I have just had to get rid of my CEO due to behaviour, communication and greed. He was a great technical guy, but when it came to non-technical skills he caused to many problems and had to go" 

The conclusion? it is the environment that we work in that either supports or inhibits action. It is the application appropriate process that prevents or mitigates undesirable events. Ultimately it is the people and their behaviors that are the source of compliance or ignorance to due process. 

So how do we assess Resilience? I am taking two main bodies of work; ISO 9004 standard uses a maturity scale to establish how well an organization has embedded a process. This concept is based on established and well documented research (Keil Institute) on Safety Culture. The second, a paper (Smith 1995) on the 7 C's of Crisis. This body of work looks at the 'weak signals' leading to crisis and failure using the Titanic as an example. He lists, 

• Culture – The common behaviors and styles, greed (power, money) 
• Communication – Effectiveness and speed 
• Configuration – of the organisation and environment
• Control – of the people (eg. competence) and systems (eg. control barriers)
• Complexity – of the systems, can't understand how they work or lack of technical competence in the team 
• Contingency – or lack of, when things go wrong 
• COST – cutting not optimisation 

By scaling these elements you can assess the resilience, that is the stronger the element the more resilient the organisation is.

What do we do now? All well and good getting an idea of how resilient your organisation is however the mitigation is about Leadership non-technical skills (also known as Crew Resource Management). The basics are that

"if a leader does not understand the consequences of the decision, the probability and the organisation is not resilient then an incident will escalate".

At 'Step Change in Safety' we are currently working through all this and are targeting launching guidance for the Energy Industry by the end of the year.