Content area
Full Text
The spotlight is on risk management these days, largely because of recent catastrophic failures such as multiple crane accidents, a massive propane explosion in a large metropolitan area and a nationwide food-borne illness outbreak in packaged food products. Why have so many failures occurred when risk programs were likely in place? How can the risks and failures be avoided?
Often, risk management and root-cause analysis (RCA) are viewed as separate programs or separate tools overseen by separate individuals with varying backgrounds from different departments. After all, risk management focuses on anticipating events and RCA focuses on reacting to them, right? Not really. The RCA process should be considered part of the overall risk management process. It is designed to minimize or eliminate risk by solving problems and removing causes that contribute to risk.
When done well, risk analysis, risk management and RCA are directly tied to an organization's business goals, which in turn define the reasons an organization is in business (e.g., profits, customer satisfaction, product quality, environmental protection and worker safety). Even in a tense economic climate, world-class organizations effectively use RCA to help achieve business goals and remain strong. By integrating their programs and investing in people, these organizations are better positioned to prioritize risk management decisions and remain competitive.
Before exploring several RCA best practices that improve risk management, let's establish a baseline definition of risk and RCA. At a minimum, risk is a two-dimensional concept that involves 1) the possibility of an adverse outcome; and 2) uncertainty about the occurrence, timing or magnitude of that adverse outcome. If either factor is absent, then there is no risk (Corvello & Merkhofer, 1993).
RCA is a structured process designed to help an organization define problems that caused past events, understand the causes and prevent their recurrence. The process has four steps:
1) Define the problem.
2) Develop a causal understanding of why the problem occurred (cause-and-effect chart).
3) Identify solutions.
4) Implement and monitor effectiveness of the best solutions (Gano, 2007).
A deviation from one or more business goals normally defines the problem that needs to be prevented, while effective solutions control or eliminate known causes of that problem. Additional business goals and cost-benefit criteria help identify the best solutions. Solutions are implemented...