R2P2: Determining the acceptability of risk
Recent rail and food safety issues have prompted a lively debate on the balance between measures to reduce risks and their costs. In Reducing risks, protecting people,1 the HSE publishes its methodology for deciding whether risks from work activity are unacceptable, tolerable or negligible, and how it balances ethical, social, economic and scientific considerations in reaching its decisions.
The document sets out the basis and criteria used by the HSE in complying with its functions, including proposing new laws and standards, rather than providing guidance on what duty holders need to do. The HSE's approach to regulating health and safety is still underpinned by the diagnosis of the Robens Committee, which produced the report that led to the creation of the Health and Safety Commission and Health and Safety Executive (HSC/E) in the early 1970s:
How people view risks
Everyone is continually surrounded by risks - some from naturally occurring hazards, and some that we accept to secure a desired benefit, such as flying to go on holiday.
The way we treat risks (see box 1) depends on our perception of their relationship to us and things we value. Significant factors in the perception of man-made hazards include how well the process giving rise to the hazard is understood, how equitably the danger is distributed, to what extent individuals can control their exposure and whether risk is assumed voluntarily. The way risk is perceived is influenced by more than just the likelihood of physical harm; other factors include ethical and social considerations and even the level of trust in the ability of those creating or regulating a risk to control it. Those who do not share the judgmental values implicit in a risk assessment may see even high-quality assessments as invalid. Minor risks can produce massive reactions through "social amplification": public response to a risk can be amplified or attenuated depending on how the reporting of the risk interacts with psychological, social, cultural and institutional processes.
Broadly, hazards give rise to two categories of concerns: individual and societal.
In the wake of an event giving rise to societal concerns, confidence in the regimes and institutions that protect people can be undermined, regardless of how unlikely the event is. How hazards giving rise to societal concerns are regulated is intensely political. The prime consideration is the resources, such as time and money, required to control the hazard, compared to the detriment suffered by society if the risk from the hazard is realised.
The regulatory environment
Since Robens, there have been changes in the regulatory environment. Increasingly, regulation of risk is undertaken at an international level through legislation such as European Directives, which are binding on EU member states. For some risks, such as the release of genetically modified organisms, action needs to be taken at an international level to have any effect. For others, technology is developing so quickly that de facto international standards or practices are evolving all the time. Regulators, industry and pressure groups are calling for the international regulation of these technologies as the only effective way to prescribe appropriate standards. This pressure requires innovative forms of regulatory cooperation that take into account factors such as regulatory harmonisation, mutual recognition of standards and removals of barriers to trade.
Risks have also become more complex. The dramatic progress to minimise risks in past years was possible without unduly taxing existing scientific knowledge or available technology - for example, the requirement to guard moving parts of machinery. More recently, new and less visible hazards have emerged, such as processes that emit gasses that contribute to global warming or ozone depletion. A frequent characteristic of these new hazards is difficulty in defining exactly what risks they give rise to, even when scientific knowledge is pushed to the limit. Regulatory control measures have to reflect this uncertainty and err on the side of health and safety. It is also now more common for demands that regulation of some risks takes account of the attributes of a hazard, such as ethical considerations, as distinct from objective assessment of the size of the risk. The evaluation and management of hazards are evolving to include values not readily verified by traditional scientific methods; techniques are being developed to take account of these values, but are still at an early stage of development.
This has led to disagreement about the role of risk assessment in the regulatory decision-making process, particularly for risk with widespread consequences. Nevertheless, the HSE believes that, used properly, risk assessment can often provide an essential ingredient in reaching decisions on the management of hazards.
The industrial scene
There have been changes in industry since Robens. For example, there has been a trend towards smaller firms and outsourcing of work, and with these come increased risk to worker and public health and safety. Many large companies have fragmented into autonomous organisations working closely together. Small and medium-sized firms are now a major force in creating jobs.
Some of these changes have blurred the legal responsibilities for occupational health and safety. Traditionally, responsibilities are placed on those who create the risks or are best positioned to control them. But in some industries, there are so many players now involved that is no longer easy to identify who should be given the duties. This has led to demands from small firms for a reversion to prescriptive regulation, instead of the self-regulatory approach - a demand resisted by large firms because they do not face the same problems and are comfortable with self-regulation. The result has been the placing of greater emphasis on the status and content of the guidance that accompanies regulations.
Preferences, values and expectations
Society's preferences, values and expectations change continually. Current shifts are influenced by greater access to information, increased focus on technological risks because of the more rapid exploitation of advances in scientific and technological knowledge, and greater affluence in society. And industrial activity is less readily accepted as a way of improving living standards than when the struggle against hunger and poverty overshadowed everything else.
There is now increased scrutiny of benefits stemming from industrial activity, against potential undesirable side effects, such as the risk of being maimed or killed or of environmental pollution. This means industry has less discretion on matters where it previously had more freedom, such as a company's plans for modifying plant within its own boundary.
Society's heightened perception of risk has been accompanied by the recognition that it is now virtually impossible for many individuals to avoid risks, such as travelling by car or plane. Nor can individuals assess for themselves many of the newer hazards arising from industrialisation; they must instead rely on experts, although this trust is being eroded through experience of issues such as BSE.
Increasingly people have to rely on authoritative bodies, such as the HSC/E, for reassurance about the arrangements for protecting people and the impartiality of those arrangements. But earning the public's trust is far from easy. There is often considerable pressure on regulators (and industry) to act quickly and decisively in a climate where perceptions of harm are often exaggerated by graphic imagery. Regulating to address short-lived fears can cause problems elsewhere, for example through the misplaced use of enforcement resources.
But perhaps the most dramatic shift in values has been the pressure on regulators for clearer explanation of their approaches to the regulation of risk. This is reflected in the principles of good regulation set out by the Better Regulation Task Force (see box 2).
Against the background of these developments, the HSE uses a six-stage process for reaching decisions on risk. The boundaries between stages are not clear cut, and earlier stages may be revisited as information is gathered. Stakeholders are involved in all six stages. The current arrangement may not be in full accord with earlier regulatory decisions, nor will all future decisions necessarily follow all of the stages. Constraints include the need to fully implement EC legislation, which may require the use of Regulations rather than an Approved Code of Practice (ACoP).
Stage 1
The first stage is to decide whether the issue is one for the HSC/E. It is normally self-evident that an issue is primarily one of occupational health and safety, although the scope of the HSW Act and its enabling powers means that many of its provisions overlap with the responsibilities of other government departments. Where there is overlap, there are often demarcation agreements.
At times, the HSC/E is put under pressure to target issues where health, safety and welfare are not prime considerations, but can be a means of objecting to inequity between those who reap certain benefits and those who are put at a detriment that may include a health and safety component.
One example would be a fall in property values as the result of the development of an airport. In these circumstances, the HSE may advise the HSC that the issue should be addressed through a more appropriate avenue. Alternatively, it might suggest the HSC looks at the appropriateness of the measures in place to protect workers and the public from the risks arising from the activity, but leaves wider aspects, such as whether the activity should be entertained in the first place, for another body.
Stage 2
Stage 2 defines and characterises the issue in terms of the problems and the means for tackling them. In framing the issue, the HSE pays particular attention to whether the HSC/E, acting within their powers and arrangements, can efficiently deliver the action and whether society will consider as valid the process for arriving at a decision on the most appropriate course of action.
In framing the issue, information on the risks may be needed to decide on the proportionality of action. In these cases, the HSE will characterise the risk quantitatively and qualitatively, to describe how it arises and its impact on those affected and society at large. This is usually done through risk assessment.
The HSE uses risk assessment to help its understanding of the nature and degree of the risk. Risk assessment also helps in extrapolating, from available data, the HSE's experience of harm and for representing a large amount of scientific information and judgment as an estimate of risk.
For example, a risk assessment may show that individuals are not concerned by a risk because of its familiarity or that the expectation of harm to any one individual is low. Nevertheless, the activity giving rise to the risks may need to be regulated because of the numbers of people individually affected. An example would be regulations making the wearing of hard hats on construction sites compulsory.
Risks must be properly characterised in order to apply the risk control hierarchy promoted by the HSC/E and the EU. At the top of this hierarchy is the consideration of measures or alternatives that will avoid the hazard giving rise to the risk. Lower down are measures that will reduce the risks, given that there are no feasible alternatives to accepting the hazard.
It is implicit in the hierarchy that an activity cannot be pursued simply because measures are available to control the risks the activity entails. This is particularly true for activities where there are considerable uncertainties in the estimates of risk attached to them. Uncertainty can arise from data based on sparse statistics or from random errors in experiments, and there are established techniques for dealing with this kind of uncertainty. Uncertainty can also arise from the models used to represent the process that gives rise to the risk. The factors involved can be modelled in many ways with the assumptions for each open to question. Uncertainty in this context is dealt with through peer review, openness to alternative hypotheses and the exercise of expert judgment.
To help deal with uncertainty, the HSE adopts the precautionary principle, ie it does not use high scientific uncertainty as a reason for not taking preventative action in addressing hazards.
The HSE's policy is that the precautionary principle should be invoked where:
Stage 3
Once the problem has been characterised, the options for managing the risk are identified. These will include: doing nothing; introducing measures that will eliminate the cause of the problem; reduce the risk to one that people are prepared to live with so as to secure certain benefits, confident that the risk is worth taking, and that it is being properly controlled (see box 3). In looking at the options the HSE will examine:
Stage 4
During the fourth stage in the process, the HSE reviews all of the information with a view to adopting the most appropriate option for managing the risks. The key to success is ensuring that, as far as possible, the interested parties are content with the process for reaching decisions and with the decisions themselves. This may not be easy, particularly where parties have opposing opinions based on differences in fundamental values.
The parties need to be satisfied about the way uncertainty has been addressed and the plausibility of the assumptions made. The HSE attempts to meet this demand by: focusing on the uncertainties that matter; explaining why a particular method was chosen in preference to others for estimating the risk; and by being open on the science, assumptions and other inputs that contributed to the value or judgment obtained from the risk assessment.
The parties also need to be satisfied about how other factors, such as economic, technological and political considerations, have been integrated into the decision-making process.
Success in this area lies in accurately reflecting what society sees as acceptable risk. At times, to take account of uncertainty and the need to adopt a precautionary approach, this might mean focusing more on the consequences of harm occurring from a hazard than on the likelihood that the hazard will be realised.
Stage 5
Once the HSE has reached a decision on the necessary degree of risk control, it must then decide on how the decision can be implemented using the regulatory tools at its disposal, such as new legislation, new guidance or enforcement action.
In constructing a regulatory tool, the HSE's approach:
Stage 6
Finally, the process for ensuring risks are properly managed would not be complete without an evaluation of the effectiveness of the action taken. Decisions are reviewed after a suitable interval to establish:
Reaching decisions
Though all the stages described in the decision-management system are important, adherence to stage 4 - reaching decisions - is crucial if decisions are to be supported, implemented and used to help to get other stages right. Reaching the right decision depends on the criteria used for deciding whether a risk is unacceptable, tolerable or broadly acceptable.
Three "pure" criteria are used:
In many circumstances, these criteria work well on their own, but they are not universally acceptable. An equity-based criterion often means decisions are taken on a worst-case scenario that bears little resemblance to reality, and where risks are systematically overestimated, causing undue alarm among the public and benefits that are achieved at a disproportionate cost. A utility-based criterion tends to ignore the fact that there are ethical and other considerations to consider, whereas a technology-based criterion often ignores the balance between costs and benefits.
The tolerability of risk
But these "pure" criteria are not exclusive and the HSE has developed a framework that accommodates all three. The strength of this framework, known as the tolerability of risk (TOR), is that it capitalises on the advantages of the "pure" criteria, while avoiding their disadvantages. It also applies similar tests to those applied by people in everyday life to reach decisions on risk. Some risks are ignored and others will not be entertained, but people decide to take many risks because of trading off the benefits of taking the risks against the precautions that mitigate their undesirable effects.
The framework is illustrated in figure 1. The triangle represents the increasing level of risk for a hazardous activity. Any activity falling in the "unacceptable" region is regarded as unacceptable whatever the level of benefits associated with the activity. The activity or practice would be ruled out unless it can be modified so that the risk falls into one of the lower categories or there are exceptional reasons why the practice or activity should be retained.
The zone at the bottom of the triangle represents risks that are broadly acceptable, ie they are generally regarded as insignificant and adequately controlled. The HSE, as a regulator, would not normally require further action to reduce risks unless reasonably practicable measures are available.
The central zone in the triangle represents risks from activities that people are prepared to tolerate in order to secure benefits. The expectation is that these risks are properly assessed and the results used to determine control measures; the residual risks are not unduly high and are kept as low as reasonably practicable (ALARP), and that the risks are reviewed periodically to ensure they still meet the ALARP criteria. Benefits for which people will generally tolerate risks include employment, personal convenience or the maintenance of general social infrastructure, such as the production of electricity.
The framework essentially applies an equity-based criterion for risks in the unacceptable zone and a utility-based criterion for the lower two zones. Technology-based criteria complement the other criteria in all three zones.
Tolerable and acceptable boundaries
The TOR framework can be applied to all hazards; what is unacceptable, tolerable or broadly acceptable in specific circumstances is often spelled out or implied in legislation, ACoPs and guidance, or is reflected in what constitutes good practice: there is no need to set explicit TOR boundaries. But the HSE, based on its experience, does follow indicative criteria as to where the boundaries lie for risks entailing individual or multiple deaths.
The HSE believes that an individual risk of death of one in a million a year for both workers and public corresponds to a very low level of risk and should be used as a guideline for the boundary between the broadly acceptable and tolerable regions. This compares with a typical background level of risk of death in our day-to-day environment of one in a hundred a year, averaged over a lifetime.
While an individual risk of death of one in a million a year is very low, many activities with a residual risk of this level also bring benefits that contribute to lowering the background level of risk. For example, electricity kills people every year and its use entails an individual risk of around one in a million a year, but it also saves many more lives by providing light and heat etc.
Tolerable and unacceptable boundaries
The criterion for the boundary for individual risk between tolerable and unacceptable is not as widely applicable. This is because high levels of individual risk are likely to engender societal concerns, for example on equity grounds, although the converse is not true. Society can be seized by hazards that pose, on average, low levels of risk to any individual, but that could impact unfairly on vulnerable groups, such as the young or elderly.
Exposure of an individual to a low level of average risk may not be acceptable, as judged by a socio-political response, because of the totality of risk across the affected population in particular events, such as a railway disaster.
In its document on the tolerability of risks in nuclear power stations, the HSE did suggest that an individual risk of death of one in a thousand a year should represent the dividing line between what is tolerable for any substantial category of workers for any large part of a working life and what is unacceptable for any but exceptional groups. For members of the public who have a risk imposed upon them in the "wider interest of society" this limit is judged to be one in ten thousand a year. These limits rarely bite, and the risks in most UK industry are much lower than this.
Societal concerns
The HSE has developed criteria for the tolerability of risks for hazards giving rise to societal concerns, although it acknowledges this is difficult.
When there is a risk of multiple fatalities occurring in a single major industrial activity, the HSE has suggested a limit of tolerability, particularly for incidents where there is some choice whether or not to accept the hazard. For existing activities, the risk of an incident causing more than 50 deaths should be regarded as intolerable if the frequency is estimated to be more than one in five thousand a year. If an installation is at the planning phase, the HSE's criteria for advising against development because of societal concerns are based initially on the level of individual risk a year, calculated for a hypothetical person, together with certain characteristics of the development.
The HSE advises against the granting of planning permission where individual risk of death for the hypothetical person is more than 10 in a million a year, and does not advise against granting permission on safety grounds if the individual risk is less than one in a million a year. Developments where the individual risk lies between these figures are scrutinised more closely and other factors are taken into account.
Applying TOR
The HSE's approach to applying the TOR framework aims to ensure that hazards are addressed in an inherently precautionary way and that it leads to control regimes that improve, or at least maintain, standards, while maintaining the principles of good regulation set out by the Better Regulation Task Force.
In applying the framework to policy formulation, regulatory development and enforcement activities, the HSE:
In this context, the HSE:
The HSE examines the information on individual risks and societal concerns gathered in characterising the problem (stage 2) and examining options and their merits (stage 3). Then, by applying tests of reasonable practicability and the criteria set out in the TOR framework, decides whether adoption of authoritative good practice precautions is an adequate response to the hazards. The HSE's experience is that in most cases, adopting good practice ensures that risks are controlled.
In some cases, existing good practice is not identified at stage 3, perhaps because the hazard is new or not well studied, or it is found to result in inadequate controls of risk. The HSE then examines, using the six-stage process, whether any of the other options identified at stages 2 and 3 would reduce the risks to the degree that the HSE considers appropriate. If one is found, the HSE advocates its adoption.
In some cases, no option is found to reduce risks to a tolerable level. This is the case where the risks are so high and their control so difficult that it is not possible to find reasonable control measures that the HSE feels confident would work in practice, or where it is not possible to allay the societal concerns about the risk. In these circumstances, the HSE will conclude it is dealing with activities located in the unacceptable zone of the TOR framework.
These activities are rare, and advances in technology mean that most risks can now be controlled. Also, the HSE can often allay societal concerns by giving assurance that risks are being adequately controlled through the use of progressively more stringent regulatory instruments.
Where intolerable risks are found, the HSE will consider banning the activity or process (see box 4). For existing risks, where banning would be an incomplete solution because the hazard is already widespread, remedial action has to be undertaken, such as the removal of asbestos from buildings before they are demolished.
The HSE stresses that it uses the framework and the criteria described flexibly and with common sense. For example, addressing some hazards from existing situations may require that certain activities be undertaken that would fall into the intolerable region for a short period of time, such as when the emergency services are engaged in saving a life.
Improving health and safety requires attention to the assessment and management of risk. For this to be achieved, the HSE believes it needs to raise public understanding both of the issue involved and of the HSE's understanding of the concerns of society and the values people employ when they consider matters of risk. In setting out its decision-making framework, it hopes to stimulate a more informed public debate on how to handle risk.
1"Reducing risks, protecting people", HSE Books, ISBN 0 7176 2151 0, £5 or www.hse.gov.uk/dst/r2p2.pdf.
The HSE makes a conceptual difference between a hazard and a risk. It describes a hazard as the potential for harm arising from an intrinsic property or the disposition of something to cause detriment. Risk is the chance that someone or something valued will be adversely affected in a stipulated way by the hazard. The importance of likelihood and consequence may vary depending on the situation and degree of knowledge. Where consequences are particularly serious or knowledge of the likelihood is uncertain, the HSE may focus solely on consequences, so that in effect it is concerned solely with the hazard. Courts have interpreted "hazard" and "risk" since the introduction of the HSW Act. The Act makes reference to risk, but not hazards. The Court of Appeal in R v Board and Trustees of the Science Museum ruled that "risks" in the context of s.3 of the Act - risks to people other than employees - should be interpreted as conveying "the idea of a possibility of danger". The HSE interprets "risk" in other sections of the Act in the same way. Consequently, the successful management
of risk in the workplace must satisfy the premise that anything present in
an undertaking that "presents the possibility of danger" is properly
addressed. |
The Better Regulation Task Force's principles of good regulation1 require:
This requirement for clarity and explanation is entirely consistent with the Robens report's conclusion that real progress on health and safety is not possible without the agreement of those affected and the cooperation and commitment of those playing a role in implementing decisions. 1www.cabinet-office.gov.uk/regulation/TaskForce/Principles.htm |
There are relatively few examples of processes or activities that have been banned because the risks they entail are so high and their control so difficult that it is not possible to be confident that control measures would work. One example is the manufacture and use for any purpose of 2-naphthylamine, a potent carcinogen, and its salts. Control of exposure is very difficult and the health effects are severe. The substance was banned under the Carcinogenic Substances Regulations 1967 and the ban was continued under EC Directives, now implemented by the Control of Substances Hazardous to Health Regulations 1999. An example of an activity that is
banned on the basis of societal concerns is the employment of those under
18 years of age in certain work activities where there is potential for
exposure to high levels of lead. |