How to Use Your Risk Assessments to Drive Change in Your Organisation
If you've worked in HSE for any length of time, you know the feeling. You put together a request for a repair, new equipment, training or another pair of hands, and it comes back with a no. Not now. No budget. Maybe next year.
It's discouraging, especially when you got into this work because you care about sending people home safe, protecting the plant and protecting the environment. Having that shut down can make it feel like your voice isn't being heard.
Before going further, an honest caveat. Getting things done inside an organisation is about more than logic. There's internal politics, there are personalities, and there's the way your CEO or line manager likes to hear things. I'm not going to pretend to be an expert in any of that.
What this article will do is help with the part you can control: making sure every request you put forward is tied to your organisation's own risk picture, not just to a standard or a report on its own.
Speak the Language of Cost
Start with how decisions get made at the top. Senior management thinks in numbers. A rating of "High" gets attention, but a cost gets a decision. So every request you put forward should read as a simple cost-benefit case: what the fix costs, against what failure would cost.
Most of those numbers are already in your risk assessments. A good risk matrix puts financial values on the severity scale, from minor repair costs up to major losses. Use them. If a scenario happens, its severity rank tells you roughly what it would cost the organisation in damage, lost production, fines and recovery.
Likelihood is the other half. Ground it in your own history wherever you can: incident and near-miss records, maintenance and inspection findings, and industry data for similar facilities. "Likely" carries far more weight when you can say why.
Keep it simple. Management doesn't need the full assessment in the room. They need the risk ranking, the cost of the fix and the cost of failure, clear enough to compare in a minute. Have the detail ready for anyone who asks.
That case is only as strong as the work behind it, and the work starts with where your requests come from.
Standards Tell You What. Risk Assessments Tell You Why Here.
Most HSE requests aren't hunches. They come from an audit report, an incident investigation, an international standard or recognised good practice. That's a solid starting point, and those sources deserve to be followed.
The trouble is that a standard is written for every organisation, and management is deciding for one. "The standard requires it" or "the audit flagged it" tells them a request is reasonable in general. It doesn't tell them how much it matters here, compared with everything else competing for the same budget.
That's the gap a risk assessment fills. It shows you've taken the standard or the recommendation and worked out how it dovetails into your own operation: which scenario it addresses, which barrier it strengthens, and where it sits against the rest of your risks.
Most importantly, it lets you show management the risk profile both ways:
- Where the risk sits now, with the gap as it stands.
- Where it would sit with the request in place, once the barrier is restored or added.
- The exposure the organisation carries if it isn't, for as long as the gap stays open.
Compare two versions of the same request:
Both are grounded. Only the second shows management what the request does to the organisation's risk, and what saying no would leave in place. The request stops being a recommendation weighed in isolation and becomes a decision about the site's risk profile.
A trick I like to use is to build a bowtie diagram for that one scenario and circle where the request sits on it. Management can see the threats on the left, the consequences on the right and every barrier in between, and the circled one shows exactly which line of defence the request restores. The bowtie is a great visualisation tool, and it can be adapted to almost any scenario.
Start From the Risk Assessments, Not the Wish List
None of this works unless your risk assessments deserve to be trusted. Before anything goes to management, do the groundwork:
- Make sure they're current. An assessment written for the plant as it was five years ago won't hold up in a budget meeting.
- Make sure they're accurate. The scenarios, consequences and barriers should reflect how the site really operates, not a template.
- Make sure they're relevant. They should cover the operations, tasks and changes that actually carry risk today.
- Make sure the barriers are honest. A control that exists on paper but not in the field isn't a control. Record the gap.
This is slow, unglamorous work. It's also what turns your requests from "the standard says" into "the risk assessments show".
When the Answer Is Still No
Sometimes, even with strong evidence, the answer will be no. But a no to a request tied to your risk profile is a decision to carry a known risk. Make sure it's recorded: who made it, what risk it leaves in place, and when it will be reviewed. Keep the gap on the risk register and bring it back at the next budget cycle.
That isn't about protecting yourself. It's about making sure risk is accepted deliberately, by the people with the authority to accept it, rather than by default.
Leave Everything on the Pitch
You can't control every outcome. You can't control the politics, the budget or the personalities. What you can control is whether you did the work.
If you've assessed the risks properly, kept those assessments accurate and relevant, ranked your requests by what the evidence shows, and put that case clearly in front of the people who decide, then you've left everything on the pitch. Whatever the answer, you won't be left wondering whether you could have assessed one more thing or made the case a little stronger.
And more often than you might expect, that kind of case gets a yes.
It's the same idea behind Risk Assess Everything: strong risk assessments don't just sit underneath your safety management system. They give you the evidence to improve it.
