Between an Identified Risk and an Eliminated One Lies a Management Decision
Identifying a risk means acknowledging a problem. Assigning an action means setting a direction. Yet between these steps and actual risk reduction lies the hardest part: selecting an engineering solution, assigning an owner, securing funding, and seeing the work through to completion.
This is the exact stage where a risk management system is put to the test.
Over the course of developing our risk management system, we have identified 300+ red risks and closed 270+ of them. However, high-level statistics are not the only thing that matters to a leader. Behind every open red risk stands a specific question: what decision is needed right now, and who must make it?
Why a Risk Can Linger in the Register
When a risk remains open, the reason is not always a lack of action on the part of executors.
Sometimes a department sees the problem but proposes an action that fails to address its root cause. Sometimes an engineering solution exists, yet there is no alignment among operations, engineering teams, and finance. In other cases, the solution is approved, but the department’s budget lacks sufficient funds. And sometimes funding is secured, yet the work is not completed on time.
From the perspective of the risk register, all these situations look identical: the risk is open. From a management perspective, they require completely different actions.
That is why we began distinguishing between four states:
- the risk is identified, but a solution has not yet been developed;
- a solution is proposed, but not yet approved;
- the solution is approved, but not backed by resources;
- resources are allocated, but the action has not been implemented or its effectiveness has not been verified.
This level of granularity shifts discussions away from vague calls to “strengthen oversight” toward addressing the exact bottleneck.
The Risk Profile: From Hazard Description to Solution Option
The first step after identifying a red risk is developing response actions and compiling a risk profile.
In essence, this document translates a problem from the language of concern into the language of management decisions. Writing “Potential personnel injury” or “Equipment safety needs improvement” is not enough. We must understand the exact hazard source being eliminated, what barriers are already in place, why they are insufficient, and what outcome the new actions are expected to achieve.
Here, it is particularly important not to substitute genuine risk elimination with a familiar set of routine measures: an extra safety briefing, a reminder, a warning sign, or stricter supervision. Such measures may be necessary, but they can rarely replace an engineering solution.
When selecting actions, the hierarchy of controls must be respected: first consider eliminating the hazard or modifying the process and equipment, next apply engineering controls, and only then rely on administrative controls and personal protective equipment.
Technical Council or Safety Culture Committee: Where Risk, Solution, and Resources Meet
Decisions on red risks cannot be left solely to the HSE team or solely to an operational unit.
A Technical Council or Safety Culture Committee brings together the expertise needed to choose a workable option: the risk owner, operations and engineering specialists, finance representatives, and the HSE function.
Its purpose is not to reconfirm that the risk is high—that is already known. The Technical Council is there to answer different questions:
- whether the proposed action will eliminate the root source of the risk;
- whether alternative engineering solutions exist;
- what must be done until the primary work is completed;
- who is accountable for implementation;
- what funding is required and through which process it must be obtained.
If a risk profile is not approved, this should not result in a vague instruction to “revise it.” Our procedure includes a dedicated step for refining proposed actions. In other words, non-approval becomes a trigger to sharpen the solution rather than an excuse for the risk to get lost in email threads.
How the Procedure Helps
To keep this process from relying on informal personal agreements, we codified it in a business process procedure titled “HSE Risk Management System”.
The procedure links risk identification with downstream processes for response, planning, budgeting, and reporting. The overall workflow looks like this:
risk identification → action development → risk profile → Technical Council / Safety Culture Committee → approval → funding source determination → implementation → reporting.
From there, the process branches out depending on resource requirements.
If the actions require no funding, the department organizes execution and proceeds directly to implementation.
If funding is needed and funds are available within the department’s budget, the solution is executed through the relevant purchase order or requisition.
If funds are insufficient, a resource reallocation approval workflow is initiated. Depending on the situation, the decision may be escalated to the site or corporate level. For actions requiring dedicated capital expenditure, an investment track is provided.
The practical value of the procedure does not lie in the number of steps. It makes it clear exactly which stage of the process a risk is in and what decision needs to be made next.
A procedure does not make decisions for a manager. However, it prevents a concrete management question from being brushed aside with a generic “work is underway.”
Compensating Controls Do Not Equal Risk Closure
Until primary corrective actions are completed, temporary restrictions and compensating controls may be required: modified work procedures, additional inspections, restricted access, or other precautions.
It is crucial to label them explicitly as temporary. They lower the likelihood of an incident while work is in progress, but they must not automatically change the risk status to “closed.”
Closure requires verification that the planned actions have been completed and that residual risk has genuinely dropped to an acceptable level.
The same applies to extending a deadline. It is not a clerical edit in the register, but a distinct management decision: why the timeline is shifting, what risk remains during the interim period, what compensating controls are active, and who owns the new target date.
Key Questions to Ask During Management Reviews
For every red risk, a few focused questions are enough:
- What solution was chosen, and does it eliminate the root cause?
- Who is accountable for implementation?
- What funding source has been identified?
- What protects people until the work is completed?
- What tangible outcome will verify closure?
Identifying a risk demonstrates the maturity of your detection system. Eliminating it demonstrates the maturity of your management. A clear procedure ensures that accountability, resources, and action do not get lost in between.