Incident recovery - a risky business.
Risk management is more than documenting the hazards or identifying controls – it requires assessing the effectiveness of the controls selected. The attached video illustrates what can happen when risk management processes are not in place.
When assessing the effectiveness of the hazard controls, key questions to consider include:
Is the control the most effective solution to mitigate the hazard, or is it an easy stop gap to complete a task? Have you utilised the hierarchy controls for above the line solutions?
Have personnel involved in the task (i.e. the subject matter experts) been included in the risk assessment process including the review of controls?
Does the control introduce other more serious hazards?
Is the control feasible from an operational, environmental and financial perspective?
What happens if the controls fail – do you have appropriate emergency management strategies in place?
Have you risk assessed the emergency response protocol prior to and during an incident recovery?
Remember assessing the effectiveness of hazard controls is ongoing process and should not be restricted to an annual desktop review.
