This document discusses operational risk management (ORM) for flight safety courses. It provides an overview of ORM, defines key ORM concepts like risk and hazard, and outlines the six-step ORM process of identifying hazards, assessing risks, analyzing risk control measures, making control decisions, implementing controls, and supervising and reviewing the process. The goal of ORM is to protect personnel and resources while maximizing capabilities and mission effectiveness.

1. FliGhT saFeTy coUrse
Welcome
Operational Risk Management
by Tariq minhas
For Training Purpose Only 1

2. operaTional risk manaGemenT
OVERVIEW
• What is ORM - The Essentials
• Why ORM?
• The Integration Imperative
• ORM Leadership Opportunity
• ORM Applied
For Training Purpose Only 2

3. operaTional risk manaGemenT
What is Risk Management?
Risk Management is a decision making process aimed
at reducing the number of losses of people,
equipment and material due to accidents.
It is a pro-active approach to accident reduction
which has been proven on the battlefield as well as in
private sector companies.
Risk management applies to war, an emergency and
to peace time operations
For Training Purpose Only 3

4. operaTional risk manaGemenT
What is Operational Risk Management?
The risk formula : The risk formula attempts to capture
the various components which influence the amount
of risk which a hazard may produce for a community or
population.
For Training Purpose Only 4

5. operaTional risk manaGemenT
Risk :
The probability and severity of accident or loss from
exposure to various hazards, including injury to people
and loss of resources.
Risk = the possibility of loss, injury, death or other
consequence
Hazard = a destructive phenomenon or event
Exposure = duration and/or extent of a hazard
Vulnerability = susceptibility to damage or harm by a
hazard
Manageability = the capacity to respond to Needs
created by a Disaster
For Training Purpose Only 5

6. operaTional risk manaGemenT
What is Operational Risk Management?
Operational Risk Management (ORM)
The process of detecting, assessing, and controlling risk
associated with organizational operations.
It is a logic-based, common sense approach to making
calculated decisions on the various factors associated
with any kind of activity.
For Training Purpose Only 6

7. operaTional risk manaGemenT
What is Operational Risk Management?
These factors include: human(s), machine(s),
environment, management, and mission. Because
risk is inherit in CAP missions and activities, CAP
officially adopted the six-step ORM process in May,
1997 as its method for evaluating the level of risk;
identifying ways to control, mitigate, or eliminate
risk; and making decisions on whether and how to
proceed with the activity.
For Training Purpose Only 7

8. Why Do DisasTers happen?
Disaster:
A disaster is a natural or man-made (or
technological) hazard resulting in an event of
substantial extent causing significant physical
damage or destruction, loss of life, or drastic change
to the environment.
A disaster can be defined as any tragic event
resulting from events such as earthquakes, floods,
catastrophic accidents, fires, or explosions. It is a
phenomenon that can cause damage to life and
property and destroy the economic, social and
cultural life of people.
For Training Purpose Only 8

9. Why Do DisasTers happen?
• Disaster:
The word disaster implies a sudden irresistible and
unforeseen event.
Unexpected interruption of critical infrastructure
induced by nature, humans, or technology failure.
• A disaster could result in a major illness, death, a
substantial economic or social misfortune.
• At the community level, it could be a flood, a fire, a
terrorism act, a collapse of buildings in an
earthquake, the destruction of livelihoods, an
outbreak or displacement through conflict.
For Training Purpose Only 9

10. Why Do DisasTers happen?
• Disaster Risk Factors
Factors that alone or with the combination of other
factors can effect to achieve safety 10 Basic factors
to be considered;
1. Design and Construction Flaws
2. Deferred Maintenance
3.Economic Pressure
4.Schedule limitations
For Training Purpose Only 10

11. Why Do DisasTers happen?
• Disaster Risk Factors (continued--)
5.Inadequate Training
6.Not Following Procedures
7.Lack of Planning and Preparedness
8.Communication Failure
9. Arrogance
10.Stifling Political Agendas
For Training Purpose Only 11

12. Why Do DisasTers happen?
For Training Purpose Only 12

13. Why Do DisasTers happen?
• Disaster Recovery:
According to ReaR's home page, disaster recovery is
“the process by which a business function is restored
to the normal, steady state after a disaster.”
For Training Purpose Only 13

14. Why Do DisasTers happen?
Classifying Disasters;
Disasters come in many different forms mainly can be
divided in to three groups;
1. Man Made Accidents
2. Terrorist Act(Attacks)
3. Natural disasters
For Training Purpose Only 14

15. Why Do DisasTers happen?
Classifying Disasters;
Disasters come in many different forms mainly can be
divided in to three groups;
1. Man Made Accidents
2. Terrorist Act(Attacks)
3. Natural disasters
For Training Purpose Only 15

16. Why Do DisasTers happen?
Classifying Disasters;
1. Man Made Accidents
• Disasters directly caused by people
• Conflict
• Industrial events: explosions, hazardous
• materials and pollution
• Transportation events
For Training Purpose Only 16

17. Why Do DisasTers happen?
Classifying Disasters;
2.Terrorist Act(Attacks)
• Terrorist groups
• Designated terrorist organizations
• Charities accused of ties to terrorism
• State terrorism
• State-sponsored terrorism By state: Israel , Russia, India,
United States
• Organization Financing, Fronting, Training camp,
Leaderless resistance
• Fighting terrorism
For Training Purpose Only 17

18. Why Do DisasTers happen?
Classifying Disasters;
3.Natural disasters
• Tropical storms (hurricanes, cyclones)
• Floods
• Droughts
• Extreme hot or cold
• Volcanoes
• Earthquakes
• Landslides
• Tsunamis
For Training Purpose Only 18

19. WHY DO DISASTERS HAPPEN?
For Training Purpose Only 19

20. WHY DO DISASTERS HAPPEN?
• Disaster Recover Plan: A strategy to recover from a
disaster with minimum impact on infrastructure
For Training Purpose Only 20

21. OPERATIONAl RISk MANAgEMENT
Why ORM?
• It is impossible to completely reduce all risk.
• We must know to control hazards in order to
decrease the amount of risk that we are exposed to.
• To ensure necessary risks are taken
ORM:
• Is an important tool for training realism
• Provides potential to expand capabilities
• Assures necessary risk taking to enhance superiority
• Natural evolution from traditional risk management
• Systematic decision-making tool that balances risk
cost & benefits
For Training Purpose Only 21

22. OPERATIONAl RISk MANAgEMENT
OBJECTIVE of the ORM process:
Protecting people, equipment and other resources,
while making the most effective use of them.
Preventing accidents, and in turn reducing losses, is
an important aspect of meeting this objective.
In turn, by minimizing the risk of injury and loss, we
ultimately reduce costs and stay on schedule.
For Training Purpose Only 22

23. OPERATIONAl RISk MANAgEMENT
OBJECTIVE AND GOALS
MAXIMUM
CAPABILITY
PROTECT PERSONNEL &
RESOURCES
PREVENT OR ADVANCE OR OPTIMIZE
MITIGATE LOSSES GAIN
EVALUATE AND MINIMIZE EVALUATE AND MAXIMIZE
RISKS GAIN
IDENTIFY, CONTROL, AND IDENTIFY, CONTROL AND
DOCUMENT HAZARDS DOCUMENT OPPORTUNITIES
For Training Purpose Only 23

24. OPERATIONAl RISk MANAgEMENT
4 KEY ORM PRINCIPLES
1.Accept no unnecessary risks.
2.Make risk decisions at the appropriate level.
2.Accept risks when benefits outweigh costs.
3.Integrate ORM into doctrine and planning at all
levels.
For Training Purpose Only 24

25. OPERATIONAl RISk MANAgEMENT
Accept No Unnecessary Risks. 1
BUT.... NOBODY TAKES “UNNECESSARY” RISKS?
If all the hazards that could have been detected have
not been detected then unnecessary risks are being
accepted.
The single greatest advantage of ORM over traditional
risk management is the consistent detection of 50%+
.more hazards
For Training Purpose Only 25

26. OPERATIONAl RISk MANAgEMENT
2. Make Risk Decisions at the Appropriate Level
Factors below become basis of a decision- making
system to guide leaders;
•Who will answer in the event of a mishap?
•Who is the senior person at the scene?
•Who possesses best insight into the full benefits and costs of a
risk?
•Who has the resources to mitigate the risk?
•What level makes the most operational sense?
•What level makes these types of decisions in other activities?
•Who will have to make this decision in combat operations?
For Training Purpose Only 26

27. OPERATIONAl RISk MANAgEMENT
.Accept Risks When Benefits Outweigh Costs. 3
WHAT HAPPENS WHEN AN ORGANIZATION STOPS TAKING
RISKS
MERIUM-WEBSTER: “BUREAUCRACY: A system of
administration characterized by lack of initiative and flexibility,
by indifference to human needs or public opinion, and by a
tendency to defer decisions to superiors or to impede action
.”with red tapeA BOLD, RISK-TAKING ORGANIZATION IS ALWAYS
MAINTAINING
. A CHALLENGE WHEN YOUR UNIT IS NOT ON A MISSION
.ORM HELPS
For Training Purpose Only 27

28. OPERATIONAl RISk MANAgEMENT
4.Integrate ORM Into Doctrine and Planning At All Levels.
This is the one we
Loss Control Operational !!want
Staff Injects Leaders Add-
On
Operational
Process
Loss Control
Operational Operational Occurs
Process Process Within
The Process
For Training Purpose Only 28

29. OPERATIONAl RISk MANAgEMENT
WHAT IS AN “OPERATIONAL PROCESS”?
Operational Securing Building
Maintaining Supplying
Planning
and all their sub-processes
For Training Purpose Only 29

30. OPERATIONAl RISk MANAgEMENT
ORM IS BASED ON SYSTEMS MANAGEMENT CONCEPTS
5M Model
Management
Mission
Machine
Man
Media
For Training Purpose Only 30

31. OPERATIONAl RISk MANAgEMENT
THE ORM 6-STEP PROCESS
Supervise . 6 Identify . 1
and Review the Hazards
Risk Control . 5 Assess . 2
Implement the Risks
Make . 4 Analyze . 3
Control Risk Control
Decisions Measures
For Training Purpose Only 31

32. OPERATIONAl RISk MANAgEMENT
Step 1 - Identify the Hazard
Process: Emphasize hazard ID tools. Adds severity and
early detection.
Output: Significant (50%+) improvement in the
detection of hazards.
For Training Purpose Only 32

33. OPERATIONAl RISk MANAgEMENT
7 - Primary Hazard ID Tools
BROAD RANGE OF APPLICATION AT ANY LEVEL
• Operations Analysis/Flow Diagram
• Preliminary Hazard Analysis
• What If
• Scenario
• Logic Diagrams
• Change Analysis
• Cause and Effect
For Training Purpose Only 33

34. OPERATIONAl RISk MANAgEMENT
Specialized and Advanced Hazard ID Tools
• Specialized tools accomplish specific ORM objectives.
Map analysis, interface analysis, mission
protection tools, training realism, opportunity
assessment
• Advanced tools are used by specialists and
professionals to add depth to ORM applications
For Training Purpose Only 34

35. OPERATIONAl RISk MANAgEMENT
EXAMPLE: THE DRIVE TO WORK
WHAT IF ANALYSIS
.What if the car catches fire
.What if a carjack is attempted
.What if I have to take an unknown detour
.What if I run out of gas
.What if another car rear ends me
For Training Purpose Only 35

36. OPERATIONAl RISk MANAgEMENT
Step 2 - Assess the Risk
Process: All hazards evaluated for total impact on
mission or activity. Root causes determined and risk
(levels assigned (EH, H, M, L
Output: Personnel throughout the organization know
the priority risk issues of the command and of their
.function
For Training Purpose Only 36

37. OperatiOnal risk ManageMent
THE ASSESSMENT TOOLS ADD OBJECTIVITY TO
THE EVALUATION OF RISK
• Risk assessment matrix: Requires specific
evaluations of severity, probability, and when
necessary, exposure
• Totem pole: Induces the prioritization of risk issues
across functions and across the organization
For Training Purpose Only 37

38. OperatiOnal risk ManageMent
THE RISK ASSESSMENT MATRIX
KEY TOOL FOR RISK ASSESSMENT
Probability
Frequent Likely Occasional Seldom Unlikely
A B C D E
S Catastrophic I Extremely
E
V Critical
E
II High High
R
I Moderate III Mediu
T m
Y Negligible IV Low
Risk Levels
For Training Purpose Only 38

39. OperatiOnal risk ManageMent
EXAMPLE:THE DRIVE TO WORK
Type of Risk Risk Level
.What if the car catches fire MED
.What if a carjack is attempted HIGH
.What if I have to take an unknown detour LOW
What if I run out of gas. MED
.What if another car rear ends me MED
For Training Purpose Only 39

40. OperatiOnal risk ManageMent
Step 3 - Analyze Risk Control Measures
Process: Comprehensive risk control options are
developed for risks based on a worst-first basis.
Output: A full range of cost effective, mission
supportive, risk controls for the consideration of the
decision maker.
For Training Purpose Only 40

41. OperatiOnal risk ManageMent
The Risk Control Option Tools Add Scope & Depth
• Basic or “macro” risk control options: Reject, Avoid,
Delay, Transfer, Spread, Accept, Compensate,
Reduce
• Risk control options matrix: 46 specific “reduce-
focused” control options - applicable at up to four
levels in the organization
For Training Purpose Only 41

42. OperatiOnal risk ManageMent
EXAMPLE: THE DRIVE TO WORK
What if the car catches fire
MEDIUM
:Macro options
Transfer - Insurance
Reduce (use Control Options Matrix) -
Engineer gas tank
Drive defensively
Focused maintenance
Emergency response plan & equipment
For Training Purpose Only 42

43. OperatiOnal risk ManageMent
Step 4 - Make Control Decisions
Process: A decision-making system gets risk decisions
to the right person, at the right time, with the right
support.
Output: Personnel know their decision-making
authority and limitations and take necessary risks.
For Training Purpose Only 43

44. OperatiOnal risk ManageMent
ORM Uses Proven Decision-making Tools
• Decision-making systems get the decision to the
right person, at the right time, with the right
support.
• Basic cost benefit and return on investment analysis
assure maximum benefit for the risk control $.
• Decision-making matrices and other modern
decision-making tools improve decision quality.
• The leader question list induces better staff inputs.
For Training Purpose Only 44

45. OperatiOnal risk ManageMent
ESTABLISHING A DECISION MAKING GUIDELINE
EXAMPLE
RISK LEVEL DECISION LEVEL
Extremely High Wing Commander or specifically
authorized designee(Top level M)
High Group Commander or specifically
authorized designee
Medium Team leader, or senior leader on
the scene
Low Any person in a leadership
position
For Training Purpose Only 45

46. OperatiOnal risk ManageMent
EXAMPLE:THE DRIVE TO WORK
What if the car catches fire
MEDIUM
(Who decides: Vehicle owner(s
Control: Emergency response plan & equipment
: Decision Cost of control
Cost of loss
Fire extinguisher $15
Deductible - $500
?Rate increase
Car down-time
Repair/Replacement hassle
For Training Purpose Only 46

47. OperatiOnal risk ManageMent
Step 5 - Risk Control
Implementation
Process: Leaders lead, operators are involved, all
are accountable.
Output: ORM initiatives always have positive
mission impact.
For Training Purpose Only 47

48. OperatiOnal risk ManageMent
ORM Implementation Tools & Guidelines Help
Controls Click with Operators
• The involvement continuum guides the high
degree of operator input to ORM actions
• The leader involvement actions list and the leader
opportunity job aid help assure effective leader
influence
• The motivation model makes application of
modern behavior management techniques easier
For Training Purpose Only 48

49. OperatiOnal risk ManageMent
EXAMPLE:THE DRIVE TO WORK
What if the car catches fire
MEDIUM
•Transfer - Insurance Reduce - OPR: Dad
• Engineer gas tank OPR: Ford
• Drive defensively OPR: Driver
• Focused maintenance OPR: Dad
• Emergency response plan & equipment OPR: Team Mom &
Dad
For Training Purpose Only 49

50. OperatiOnal risk ManageMent
Step 6 - Supervise and Review
Process: Progress measured through increased mission
effectiveness, mishap results and direct indicators of
risk.
Output: ORM performance status determined real
time.
For Training Purpose Only 50

51. OperatiOnal risk ManageMent
Review and Feedback Procedures Measure &
Leverage ORM Results
• Eliminate invalid statistical uses of mishap rates and
numbers
• Refocus measurement on direct measures of risk
(critical behaviors, knowledge, conditions, etc.)
• Radically improve the effectiveness of feedback
systems through modern data and communications
systems
For Training Purpose Only 51

52. OperatiOnal risk ManageMent
USING THE 6-STEP PROCESS -THE RISK MANAGEMENT
CONTINUUM
PLANNING OPERATIONS AFTER-ACTION
Deliberate ORM Largely Time-critical Assess indicators
Detailed Hazard ID Change Analysis Deliberate ORM
Integration Real Time Integration
Highly Decentralized Feedback to Planning
We try to get But continue
most ORM done the process here
here and here
For Training Purpose Only 52

53. OperatiOnal risk ManageMent
USING THE 6-STEP PROCESS
LEVELS OF EFFORT
TIME CRITICAL DELIBERATE STRATEGIC
Little Lot of
Time Time
Resources Resources
Risk Risk
SELECTED PRIMARY SPECIALIZED ADVANCED
PRIMARY
For Training Purpose Only 53

54. OperatiOnal risk ManageMent
Integrating the ORM Process
Overview
• Why integration is critical?
• 12 Strategies for ORM integration.
• The importance of pace.
For Training Purpose Only 54

55. OperatiOnal risk ManageMent
WHY INTEGRATION IS CRITICAL?
Integration:
• Forces balancing of loss control and other mission needs
• Captures more of the knowledge and experience of
large numbers of operators
• Reduces the number and diversity of references needed
to do the job right
• Eliminates redundancy and gaps between loss control
functions
• Strengthens accountability
• Reduces costs and workloads (in plans, materiel
development cycles, etc.)
For Training Purpose Only 55

56. OperatiOnal risk ManageMent
THE TWELVE STRATEGIES FOR PROGRAM
INTEGRATION
1. Accountability 7. Employee Activities
2. Teaming 8. Process Integration
3. Partnership 9. Direct Change
4. Integrate in Training 10. Gain a Champion
5. Risk Decision Points 11. Integrate in Strategic
6. Organization & Planning
Policy Structure 12. Integrate into
Measurement
For Training Purpose Only 56

57. OperatiOnal risk ManageMent
THE IMPORTANCE OF PACE
• Don’t use the shotgun
• Don’t get out in front of the organization - too far
• Don’t “inspect-in” ORM
• Do focus on “targets”
• Do expect crawl, walk, run
• Patience, patience, patience
For Training Purpose Only 57

58. OperatiOnal risk ManageMent
ORM MATURATION
• Vision
• Organization Approach
• Background
• Strategy
For Training Purpose Only 58

59. OperatiOnal risk ManageMent
VISION
Macro:
Every Leader, Member, & Employee Manages Risk in All They
Do... On- & Off-Duty
Micro:
On-Duty - Every Organization Manages Normal Operational
Risk Profile
- Unique Operations Identified & Assessed
Off-Duty - Every Individual Applies Risk Management
Process to Activities.
For Training Purpose Only 59

60. OperatiOnal risk ManageMent
CAP APPROACH :
‘CAP’ Collect Data, Analyze, Prevent.
• Top-Down Approach
• Strong Senior Leader Backing
• Decentralized Implementation
• Moderate Implementation Tempo
• Safety Lead Role for Cross-Functional
Implementation
For Training Purpose Only 60

61. OperatiOnal risk ManageMent
ORM STRATEGY
Miscellaneous Initiatives
• Automated “Tools”
• Doctrine Integration
• Crosstell
• NEWS Release(s)
• Video(s)
For Training Purpose Only 61

62. OperatiOnal risk ManageMent
The leader’s role will be
a decisive factor in the
success or failure of
ORM
For Training Purpose Only 62

63. OperatiOnal risk ManageMent
ORM Leadership Opportunities
1. Commit to Breakthrough Improvement
Objectives:
Put improvement of risk performance (control-
opportunity) on a competitive level with other
important mission concerns.
2. Set Goals & Objectives
Objectives:
Establish periodic ORM performance and
programmatic goals.
For Training Purpose Only 63

64. OperatiOnal risk ManageMent
ORM Leadership Opportunities Continued
3. Set a Personal Example
Objectives: To assure credibility of the ORM process
through personal behavior.
4. Build an Aggressive Opportunity Mindset in
the Organization
Objectives: Create an organization as conscious of
the opportunity aspects of ORM as it is the risk
reduction
For Training Purpose Only 64

65. OperatiOnal risk ManageMent
ORM Leadership Opportunities Continued
5. Induce Loss Control Community Functional
Integration
Objectives: Build increasing cooperation and
integration of the loss control community
6. Establish an ORM Management Structure
Objectives: Provide the necessary leadership and
staff resources to adequately guide the ORM
process
For Training Purpose Only 65

66. OperatiOnal risk ManageMent
ORM Leadership Opportunities Continued
7. Resource ORM Activities
Objectives: Allocate resources to ORM (control-
opportunity) at a level it can competitively justify.
8. Heat Shield Subordinates
Objectives: Protect subordinates who have taken
prudent, mission supportive risks, but
experienced severe losses, from negative
consequences.
For Training Purpose Only 66

67. OperatiOnal risk ManageMent
ORM Leadership Opportunities Continued
9. Detect & Correct Gambling
Objectives: Develop an organization in which risk
“gambling” is deterred even when the gambler
“wins”.
10. Use the Power of Question
Objectives: Use pointed ORM questions to induce
ORM activity and culture change.
For Training Purpose Only 67

68. OperatiOnal risk ManageMent
ORM Leadership Opportunities (Continued)
11. Regularly Monitor ORM Progress
Objectives: Periodically assess a set of data that
effectively monitors organization ORM status
12. Exploit the ORM Value of Major Mishap
Reviews
Objectives: Consistently induce consideration of the
ORM implications of mishaps
For Training Purpose Only 68

69. OperatiOnal risk ManageMent
For Training Purpose Only 69

70. Questions and Answers
For Training Purpose Only 70