G. Dale Stewart

A few weeks ago I was approached by a Battalion Fire Chief and asked if I would discuss my thoughts on Operational Risk Management (ORM) as a tool for decision-making. ORM is a decision making tool used by people at all levels to increase operational effectiveness by anticipating hazards and reducing the potential for loss, thereby increasing the probability of a successful operation. We know that risk has always been present and humans have always dealt with risk through intuition based on past experiences. What is missing is a systematic risk decision-making process that manages risk as part of the whole operation. That is where ORM comes in. It assists us in making decisions that result in safer operations, while conserving our resources and optimizing our operational capability. This summary will provide an overview of what the ORM process includes, a description of steps, and how by using informed risk decisions you can make your team safer, more effective and better mission capable.

The purpose of ORM is to minimize risks to acceptable levels, proportional to mission accomplishment and the goal is to manage risk so the mission can be accomplished with the minimum amount of loss. The principles of ORM can be taught and effectively applied throughout the first responder community to enhance the decision-making process.

Four principles govern all actions associated with the management of risk. These
principles, continuously employed, are applicable before, during, and after all tasks and operations.

• Accept no unnecessary risk. Unnecessary risk comes without a commensurate return in terms of real benefits or available opportunities. All events and daily routines involve risk. The most logical choices for accomplishing a mission are those that meet all mission requirements while exposing personnel and resources to the lowest acceptable risk.

• Make risk decisions at the appropriate level. Making risk decisions at the appropriate level establishes clear accountability. Those accountable for the success or failure of the mission must be included in the risk decision process.

• Accept risk when benefits outweigh the costs.  All potential benefits should be compared to all potential costs. The process of weighing risks against opportunities and benefits helps to maximize team capability. Even high-risk endeavors may be undertaken when there is a well-founded basis to believe that the sum of the benefits exceeds the sum of the costs.

• Integrate ORM into operations and planning at all levels. To effectively apply risk management, commanders must dedicate time and resources to integrate ORM principles into planning and operational processes.  Risk assessments of operations are most mission supportive when they are done as a normal way of conducting a mission, not an add-on process performed by people not otherwise involved.

The nature of first responder operations requires the ORM process to be tremendously flexible. Leaders must often make tough, complex decisions in a matter of minutes, or even seconds. On the other hand, many decisions permit weeks or months of staff work.

Risk management can be accomplished on three levels. While it would be preferable to perform an in-depth application of risk management for every operation or task, time and resources may not always be available. One of the objectives of risk management training is to develop sufficient proficiency in applying the process so that risk management becomes an automatic part of the decision-making process.
The three ORM levels are deliberate, time-critical and strategic. 

Deliberate ORM is the application of the complete process.  It primarily uses experience to identify hazards and develop controls and is therefore most effective when done in a group.  An example of a deliberate application includes disaster response planning.  Deliberate ORM usually takes place well in advance of an activity - in the planning stages when there's plenty of time to methodically go through the steps and develop informed risk decisions.  This is where you should try to get most ORM done.  Early, deliberate ORM in the planning stages helps to fully integrate risk controls into activity plans.

Time-Critical ORM is just what the name implies. It's an "on-the-run" mental or verbal review of a situation using the basic risk management process without necessarily recording the information. This time-critical process of risk management is employed to consider risk while making decisions in a time-compressed situation. This level of ORM is used during the execution phase of an operation as well as crisis response situations. Time-critical ORM is particularly helpful for choosing the appropriate course of action when an unplanned event occurs during execution of a planned operation or daily routine.

Strategic ORM is used to study the hazards and associated risks in a complex operation in which the hazards are not well understood.  This level is a long-term application that involves research, various analysis tools and long-term tracking of the associated hazards.  This level of ORM is typically used for high-visibility risks and requires a lot of time and resources.

ORM is a comprehensive system for improving individual and organizational performance in all areas and operations and must be tailored to meet the unique mission needs and operational requirements of each department. It is a continuous,
systematic decision-making tool consisting of six steps that define the process.

Identify the Hazards. Step one of the process involves application of appropriate hazard identification techniques in order to identify hazards associated with the operation or activity. Hazards are defined as any real or potential condition that can cause mission degradation.

Assess the Risk. The assessment step involves the application of quantitative or qualitative measures to determine the probability and severity of bad effects potentially resulting from exposure to a hazard.

Analyze Risk Control Measures. Step three involves the evaluation of specific strategies and controls that reduce or eliminate risk. Effective mitigation measures reduce one of the three components (probability, severity, or exposure) of risk.

Make Control Decisions. Decisions are made at the appropriate level and are based upon analysis of overall costs and benefits. Decision-makers choose the most mission supportive risk controls consistent with ORM principles. Before you start making risk control decisions, keep these guidelines in mind:

• Make decisions at the right time. It is important to review the mission and identify the right time for risk decisions. Make decisions as late as possible to allow more
  time for collecting and considering hazards and associated risks. Don’t wait too long, or decisions can’t be effectively integrated into the overall mission.

• Make risk control decisions at the right level. That level is the one that can best judge the full range of issues involved. It is also relevant to keep the person who 
  would take the heat if the mission fails.

Implement Risk Controls. Once control measures have been selected, an implementation strategy must be developed and carried out. As you design the plan for risk control implementation, keep two things in mind to help ensure success:

• Make implementation clear
• Establish accountability
• Provide support at all levels

Supervise and Review. Risk management is a process that continues throughout the life cycle of the system, mission, or activity. Leaders at every level must fulfill their respective roles in ensuring controls are sustained over time. Once controls are in place, the process must be periodically reevaluated to ensure their effectiveness and mission supportiveness.

ORM provides a logical and systematic means of identifying and controlling risk. ORM is not a complex process, but it does require individuals, supervisors and leaders to support and implement the basic principles on a continuing basis. ORM offers individuals and agencies a powerful tool for increasing effectiveness and reducing mishaps. The ORM process is accessible to and useable by everyone in every conceivable setting or scenario. It ensures that all personnel will have a voice in the critical decisions that determine success or failure in all your missions and activities. Properly implemented, ORM will always enhance mission performance.