Risk Assessment Flashcards

What is the purpose of a 'risk register' in an organization?

Answer: A centralized record of all identified risks, their ratings, assigned owners, control measures, and review status — used to manage and monitor organizational risks systematically

A risk register captures all significant identified risks (occupational H&S, environmental, business, regulatory), their likelihood and consequence ratings, the control measures in place, residual risk rating, who is responsible for each risk, and when each will be reviewed. It provides management visibility and enables prioritization of risk control resources.

Why is 'consultation' with workers important in risk assessment?

Answer: Workers have first-hand knowledge of actual hazards and working conditions; consultation improves quality of assessment and increases worker compliance with controls

Workers performing a task daily observe hazards that managers and safety officers may not notice. They can identify practical problems with proposed controls. Worker consultation is also legally required under most H&S legislation (including UAE and Saudi regulations implementing ILO principles) and produces more practical, accepted, and effective risk assessments.

What does 'tolerable risk' mean in risk assessment terminology?

Answer: Risk that has been reduced to as low as reasonably practicable and is accepted because it would cost a grossly disproportionate amount to reduce further — it does not mean the risk is ignored

The ALARP (As Low As Reasonably Practicable) framework distinguishes: broadly acceptable risk (very low, minimal control needed), tolerable risk (significant but justifiable benefit; must be ALARP), and unacceptable risk (too high under any circumstances). Tolerable risk must still be managed to ALARP — it is not ignored.

What is the difference between 'quantitative' and 'qualitative' risk assessment?

Answer: Qualitative RA uses descriptive ratings (low/medium/high) and expert judgment; quantitative RA uses numerical probability and consequence data to produce numerical risk values

Qualitative risk assessment (most common in occupational H&S) uses descriptive judgments — likelihood and severity rated as low/medium/high with a risk matrix. Quantitative RA (used in major hazard industries — oil/gas, nuclear, chemical plants) uses statistical failure rate data, fault tree analysis, and numerical risk values (e.g., 10⁻⁶ per year). Gulf petrochemical QRA is regulatory requirement.

What is a 'significant finding' in a risk assessment and what must be recorded about it?

Answer: A hazard that poses a real (not trivial) risk — records must include: hazard, who is at risk, existing controls, further actions required, and person responsible and timescale

Significant findings are those where meaningful risk exists after considering the hazard and who could be harmed. The record must show: what the hazard is, who is at risk, what controls are already in place, what further action is needed, who is responsible, and by when. This constitutes a legally defensible record of compliance.

Under what circumstances can informal (unrecorded) risk assessment be acceptable?

Answer: For very low-risk activities with obvious, widely understood hazards and standard controls — formal written records are legally required when significant risks exist or for organizations with 5+ employees

Trivial risks with obvious controls (crossing a car park, making a cup of tea) may not require formal written records. However, for significant risks, non-routine work, complex environments, vulnerable workers, high-severity potential, or when legally required (5+ employees in UK/equivalent), formal written risk assessments are mandatory.