Risk Audit Guide
What is a hazard?
A hazard is a source of harm, such as materials, substances, sources of energy, processes, practices, and conditions. After a hazard is identified, the corresponding risk can be identified.
​
What is risk?
A risk is the chance of harm resulting from a hazard. This applies to health, bodily safety, equipment, and property. Examples include sharp objects, high temps, electricity, slippery surfaces, asbestos, and chemicals.
​
Why is risk assessment important?
Risk Assessment identifies hazards, determines who & what may be at risk, evaluates the risk, and determines the best way to control the risks. It includes a time horizon.
​
The overarching goal of a risk audit is to seek out problems before they occur to minimize loss of: finances, human capital, property, information, customers, and vendors; plus, mitigate external threats. The twenty-five (25) components of a Risk Audit include:
1. Risk assessment step: identify, determine, evaluate, control
2. Likelihood scale: from 0 (impossible) to 4 (>25%)
3. Risk categories: physical, location, human, technology
4. Walk arounds: what to consider & common issues
5. Levels of impact: low, medium, high
6. Consequence scale: from 1 (insignificant) to 5 (catastrophic)
7. Prevention vs Recovery: Determine cost, resources, & time of prevention vs recovery
8. Safety protocols: common within my industries
9. Communication: identify, consider, tailor, choose
10. Control measure hierarchy: eliminate, substitute, isolate, engineering, administrative, PPE
11. Evaluations: when to conduct, methods used
12. Managing risk: avoid, reduce, transfer, accept
13. Accident reporting: employee, supervisor, medical provider
14. Accident response plans: establish, determine, collect, secure
15. Emergency action plans: evacuation, critical procedures, responsible parties, and more
16. Training: type topical (electrical safety, fire safety, and more)
17. Business impact analysis: interviews, questionnaires, reports, research
18. Identifying vulnerabilities: data validation, prioritization, findings
19. Disaster recovery plans: people, facilities, technology, data, suppliers, policies & procedures
20. Disaster recovery plan documents: from objectives & assumptions to procedures for returning to space
21. Testing systems: purpose, objectives & measurements, collection of results, evaluation of results, plan updates
22. Disaster recovery for IT: threat modeling and cold, warm, hot sites
23. Enterprise Risk Management: recommended ERM software
24. Standards: ISO, ANSI, OSHA, and more
25. ISO 31000: develop a risk management culture and awareness of the importance of managing and monitoring risk
Please contact us for more information or to schedule a Risk Audit for your company, today.