Risk management

The organisation uses one 5 by 5 risk matrix: how likely, and how severe. The labels, colours, and the score you are willing to tolerate are set once. Assessments store a copy of that matrix when they are submitted or approved, so an old rating does not change if the matrix is edited later.

• Baseline Risk Assessment. A formal assessment for a site or an activity. It has participants, an approval step, and a locked version once it is approved. Computer only.
• Issue-based Risk Assessment. A shorter assessment started from an observation, inspection, investigation, action, or asset. Computer only.
• Take 5 (Pre-task Risk Assessment). A short check before a task: what you are about to do, the hazards, the risks, the ratings, and the controls. Created on the phone or the computer. The phone path works offline and can include a photo and a location.

• Formal assessments use a hazard register. Each row has the task, the hazard, the risk before controls, the risk after controls, and a target.
• Take 5 uses a simpler card for each hazard.
• From an assessment you can raise actions.
• A bow-tie diagram (threats, barriers, the hazard, mitigations, consequences) can be drawn for a formal assessment and downloaded as a PDF.
• A standalone risk register holds hazards you want on a list even when they are not inside a full assessment.
• Owners can be reminded when a formal assessment is due for review.