The Use of Ignorance in Health & Safety Decisions

Risk! Engineers Talk Governance Podcast
Season 7, Episode 6

In this episode of Risk! Engineers Talk Governance, due diligence engineers Richard Robinson and Gaye Francis explore the use of ignorance in health and safety decisions and how it’s being used to not make decisions and not deliver the best safety outcomes for organisations.

Richard and Gaye examine the growing trend of shorter board tenures and how this lack of long-term intellectual property can affect diligent decisions, especially when directors lack deep familiarity with the technical hazards their organisations face. They also discuss how decision-makers often surround themselves with people who won't ask uncomfortable and challenging questions, or filter information that reaches Boards.

They also discuss optimism bias and the commercial tendency to dismiss risk as pessimism. They argue that the SFAIRP (So Far As Is Reasonably Practicable) framework demands more than just taking action on known hazards. It requires a clear, documented justification for inaction — and that justification needs to be revisited continuously as technology, knowledge, and circumstances evolve.

They conclude that genuine safety governance isn't about guaranteeing nothing bad will ever happen, but being able to look the next of kin in the eye and say, hand on heart, that everything reasonable was done.

The SFAIRP moral imperative versus commercial reality.

Access the episode’s full transcript below.

Episode transcript

Megan (Producer) (00:00):

Welcome to Risk! Engineers Talk Governance. In this episode, due diligence engineers, Richard Robinson and Gaye Francis discuss the use of ignorance in health and safety.

(00:13):

We hope you enjoy the chat. If you do, please support our work by giving us a rating and subscribe on your favourite podcast platform. And if you'd like more information on R2A, our newsletter and resources, or have any feedback or topic ideas, please head to the website www.r2a.com.au.

Gaye Francis (00:34):

Hi, Richard. Welcome to another podcast session.

Richard Robinson (00:37):

Good to be here again, Gaye.

Gaye Francis (00:39):

Today we're going to talk about the use of ignorance in health and safety and in the way that sometimes it's used to make decisions or how they gain information.

Richard Robinson (00:51):

Well, not make decisions, might be more relevant.

Gaye Francis (00:56):

True, true. And how it's being used to maybe not give the best safety outcomes for organisations.

Richard Robinson (01:06):

Well, this is actually a number of levels. I think we were sort of just talking about this in advance, trying to work at what we're going to say.

Gaye Francis (01:12):

Always a good thing!

Richard Robinson (01:13):

What we observed is being used at a number of levels because we've observed the churn at board level.

Gaye Francis (01:17):

Yes.

Richard Robinson (01:17):

And then we observed a whole lot of directors turn up who don't know much about this stuff. And what was that line from that director you said?

Gaye Francis (01:25):

You wouldn't expect us to know all of the hazards that our organisation is exposed to.

Richard Robinson (01:29):

Well, the ones that can kill a maim, the people who work there, yes, you would.

Gaye Francis (01:33):

I think just explaining those couple of points. We've been in business (R2A) for a while, Richard, a long time. And the boards that we've seen over the years, I think their tenures are becoming shorter. They used to be, 20 years ago used to have quite stable boards that have been with the organisation for a longer period of time. We're now seeing typically that tenures are sort of in that five-year sort of span. And I know that there's strategies that go on that you don't turn your whole board over every time and you try and keep half. But the continuity of information in a board, especially when you're talking about boards that are responsible for technical issues or technical organisations and service delivery organisations, that you've got a longer horizon. They're typically boards that are going to be running, or sorry, organisations that are going to be running for 20 years and 30 years, 50 years for that investment cycle for renewal of infrastructure and things like that.

Richard Robinson (02:36):

Dams and things like that. Remember I was on a ministerial panel and the most notable result of which is that I discovered that the minister's never wrong. That's the first thing I discovered. But one of the reasons why, as far as I can tell it happened, was that they used to make sure they had a dam safety expert on the board and then that person retired, just age and things like that. And rather than appoint a new dam safety expert, they said, "No, no, we'll appoint a commercial board member and you can just retain consulting engineering advice as required." Well, that's not quite the same as having a person who actually knows about dam safety on the board.

Gaye Francis (03:10):

Yeah. Well, it's got two things there, hasn't it? Because the board has to know what questions to ask.

Richard Robinson (03:16):

Correct.

Gaye Francis (03:16):

And when to bring in the dam safety expert. And then they've got to interpret that information to make those decisions.

Richard Robinson (03:23):

Well, that's one of the reasons why I think I've observed is that ignorance is actually being used as a tool, because sometimes what seems to happen, if you've got a board member who's perhaps overly active in a certain area, when their retirement comes up, you find a new board member with other skills who doesn't actually share that same interest. But that means, in a sense, you're surrounding yourself with ... Well, it's a bit like I keep talking about autocrats. What they do is surround themselves with yes people, so they don't actually get the information they actually need. And the whole point of our democratic process is that you try to get the right information, even if you don't want to hear it.

Gaye Francis (03:58):

And I think going back to that, and they're getting the information to maybe from a governance and a liability management aspect rather than improving the safety aspect of an organisation long term.

Richard Robinson (04:13):

Well, it's very Owellian. I mean, it's one of those things.

Gaye Francis (04:16):

It's very what? Sorry.

Richard Robinson (04:17):

Orwellian.

Gaye Francis (04:18):

Orwellian.

Richard Robinson (04:19):

George Orwell, 1984 and all that sort of good stuff.

Gaye Francis (04:22):

Oh, okay. Please fill us in. Enlighten.

Richard Robinson (04:26):

I'm not sure I can give you a rapid summary of the entire book on this particular podcast.

Gaye Francis (04:32):

What's the relevance of?

Richard Robinson (04:33):

Well, that's just the basic way totalitarian systems work. You basically give people the information that you ... So they only know what you need them to know.

Gaye Francis (04:40):

Want whem to know.

Richard Robinson (04:42):

Want them to know. So they'll give the answer the way in which you wish to get it.

Gaye Francis (04:45):

Right.

Richard Robinson (04:46):

I mean, that's partly why you put people in silos. But if you leave people ignorant, well...

Gaye Francis (04:51):

But I thought one of the key things and the role to the board was to ask the difficult questions and to challenge the status quo in a way.

Richard Robinson (05:03):

Well, in a sense, the whole reason for the Work, Health and Safety legislation because boards weren't doing it when awful things happened.

Gaye Francis (05:10):

Yes.

Richard Robinson (05:11):

And so I mean, I don't know if people ever really is on the ball, but if you're a long-term director and they saw something awful happen.

Gaye Francis (05:21):

So do you think part of it is that because we've gone to shorter term tenures that people aren't seeing these bad things?

Richard Robinson (05:28):

Yeah, but I think it's got to do with the entire hierarchy. I remember I told a long, long time ago, I got seconded as a safety manager for an oil company and I had to go and look at all the oil terminals around Australia. Now, what I didn't know is the fellow that I got seconded to, he was a personal friend of the Managing Director of said company, and he'd been with the company for about 25, 30 years, and the whole organisation knew him. And when he turned up, because they'd had some health and safety problems, and when he turned up doing this audit with me tagging long taking notes and generally doing the legwork, which is what young people do, what I'd sort of worked out later was because when this guy turned up, the organisation knew who he was, and they knew he had a direct connection to the CEO, and so that if this fellow said, yeah, that's an issue, I will bring it to the attention of the CEO and he'll bring it to the board.

Gaye Francis (06:18):

It was escalated.

Richard Robinson (06:19):

I can't guarantee what the result will be, but I can guarantee it will be raised. Everyone believed him. And the direct consequence of that was their health and safety statistics abruptly improved. But that required somebody who'd been with the organisation for a long time that everybody knew and trusted. And that trust part was the key bit.

Gaye Francis (06:37):

It's the trust thing, isn't it? And the communication up, I think, and we've talked about this, not necessarily in this season, but in other seasons about the truckload and the information load that is actually going up to the boards in the risk and health and safety space, that it's not understood and it's sort of become, oh, we keep putting all of this information up, but it's not in a way that can be done.

Richard Robinson (07:02):

Wheel barrow loads and nobody understands it.

Gaye Francis (07:04):

They don't understand it. How do you actually get through it and get to the bits that are actually important?

Richard Robinson (07:10):

Remember, I mean, it's a while ago now, there used to be this thing, I forget, it was sort of one of those James Reason-ish things where you actually sent somebody to go and talk to everybody. I remember the funniest one was, remember that water company I got the job for? The bigger water company had taken over the smaller water company and they'd been forced to upgrade the water supply to a Class A water, which was just a holiday settlement. So basically a lot of people turned up in summer, the rest of the year, everyone just used tank water, and didn't care. But anyway, they'd been forced to upgrade it. But what had happened was because the water supply had been upgraded, all the tourists turned up in summer and drank the place dry where previously they avoided the water.

Gaye Francis (07:47):

So you add your supply and demand bit as well.

Richard Robinson (07:51):

But the funny thing was, when I turned up, I started wandering around talking to the people who work for the smaller water company. And I was asking all these questions and this guy, some character turns up in a suit asking the guy actually doing the job, the question, you can sort of see them look at you with a fair degree of suspicion, what are you and who are you and what do you want? And I was busy writing down these notes, what this guy said. And he was looking at me astonically said, you're actually writing down what I'm saying, aren't you? And I said, yeah, I'm really writing down what you're saying. And I said, I can't guarantee because the smaller company had been overwhelmed by the new company's rules and processes and they were just frustrated even though they had quite a good process in the team, they were just getting a hard time. And I said, look, I can't promise that anything will get done, but what I can promise is I always tell them competently what you guys are doing, the good bits are doing, the bad things that are happening. And I can promise them to tell you that. Now, I actually can't remember if the company did anything, that's our problem, we do our bit and then we move on.

Gaye Francis (08:52):

I do remember that job, but I think they took some of the cultural issues or the cultural benefits.

Richard Robinson (08:57):

From the small one.

Gaye Francis (09:01):

Into the big organisation

Richard Robinson (09:02):

I think they did.

Gaye Francis (09:03):

They had a really good team environment and culture of reporting issues. Whereas sometimes we see that issues in larger organisations are often buried and not escalated to the level that they need to be.

Richard Robinson (09:15):

Well, what's like that stoplight thing, which I think seems to have disappeared, the red, amber, green business where if you've been blocked by the normal line management getting something done, you had the right to report it and once a week, I think it was, the senior management got a red amber green. And if red meant that there was an issue that had been tabled, but nobody looked at it yet. Amber means it was being thought through. And green meant it had been dealt with. And every week, all senior decision makers, all GMs got a summary of what the troops were directly reporting.

Gaye Francis (09:44):

I think everybody in the organisation had access to that. So you could report a red issue and that would in the health and safety sphere.

Richard Robinson (09:52):

You didn't want to be a serial whinger because that would have other consequences.

Gaye Francis (09:56):

That's right. And I think people were primarily using it for those kill and maime, those really...

Richard Robinson (10:00):

People were frustrated by things that weren't <getting done>. Well, the one that particularly annoyed them was when something broke down, a remote SCADA instrument broke down, somebody goes out and fixes it and a week later it's <broken> again and they do it again and there's bung again, you do it again. Well, after a while, you don't keep fixing it. It's got to be properly dealt with.

Gaye Francis (10:21):

Yes. So it's closed.

Richard Robinson (10:23):

But if it's an important thing that's going to stop something critical happening, then you really need to make sure it's working. So it was a backup to the QA system, I suppose.

Gaye Francis (10:32):

So I think we talked about ignorance being endemic and that sometimes it's being used as a tool to not give the right information so decisions can be made. But we also had in this one that we might talk a little bit about testing optimism bias.

Richard Robinson (10:49):

Yeah. Well, that's sort of ... I mean, in the commercial world, the commercial world generally is a bunch of optimists okay because they sort of look at the upside downside and risk and say, ooh, we could make all this money and get all these things and this, that and the other thing.

Gaye Francis (11:00):

I think they also look at it and say for the health and safety aspects, oh, that's not going to happen, so we don't have to worry about it.

Richard Robinson (11:07):

Well, it's more than that. They sort of say all those risk people, I mean, they're a bunch of pessimists, they'll never let us do anything. And at one level, they're probably right, but they still have to think it through. I mean, I think the whole point of the due diligence part, it isn't that you can't be optimistic, but if the pessimist put up something, you must explain why it's not reasonable to do it.

Gaye Francis (11:29):

And I think that's what comes back to that SFAIRP approach, isn't it? And we've said this a number of times, it's often more important to say why you're not going to do something compared to justifying why you are going to do something.

Richard Robinson (11:40):

I did get that enquiry about the report we did several years ago now saying, 'you need to do these things', and the question came back, well, it's not been done anywhere else on the site. And I said, well, there's a reason for it, there's a hazard next door. But at the time, that's what was needed to get it through all the regulatory hoops and loops. So to change it now would be very difficult and it wasn't prohibitively expensive. That's the point.

Gaye Francis (12:04):

I think it also comes back to, just on your point there, the SFAIRP approach is a snapshot in time, but it doesn't mean that you can then put it on the shelf and let it go. Technology's changing all the time, more information's becoming available, you should be able to make better decisions with the information. So I think this is something that has to be a continuous improvement, continuous process as an ongoing governance exercise at that board level.

Richard Robinson (12:37):

Yeah, that's right. If it can kill and maime. Then you need to show that you've done every reasonable practical thing you can to stop it going wrong. It doesn't mean it still can't happen. It's like that CFA (Country Fire Assoc) captain. He said, you know what? I know if I stay being a volunteer fire captain for another 10 years, <there will be> a fatality and I need to be able to look the next to kin in the eye. It's got nothing to do with insurance. It's got nothing to do with liability. I need to be able to look the next to kin in the eye and say, we had done every reasonable practical thing we could to make sure this thing wouldn't happen. But fighting bushfires is an inherently dangerous activity. There are lots of variables which we can't control. It's like the two young people who got killed the by the tree. But the tree that fell downhill, but they knew the wind and going up they were already retreating.

Gaye Francis (13:25):

Yes.

Richard Robinson (13:25):

They were trying to do every reasonable thing they can.

Gaye Francis (13:28):

Just bad luck, isn't it?

Richard Robinson (13:30):

But that's one of the reasons why we had that job to design cabins so they'd be more resistant. It still won't stop if a big tree hits it square, but it will deflect it.

Gaye Francis (13:39):

Well, that comes down to our whole theme around what this podcast season is SFAIRP, the moral imperative versus the commercial reality. So it's hand-on-heart stuff. Have we done every reasonable practicable precaution we can -- control we can -- that's reasonable in the conditions that we find ourselves?

Richard Robinson (14:01):

Well, it's a bit like the bushfires. I mean, like Black Saturday was 2009, we're now 20 years on.

Gaye Francis (14:08):

We're coming up to our once in a generation bushfire time again.

Richard Robinson (14:12):

And you go and look at the bush out there and it's all grown back and it's all looking lovely and I guess we're all moving back into the bush again, or at least a new set of people's moving back into the bush. The government has put in some new rules, but we're a bunch of optimists. It is lovely out there.

Gaye Francis (14:25):

Yeah. And why wouldn't you live out there? But I mean, there's things that you can do now that are practical (now), that you have to test whether they're reasonable or not. And I think it's that long-term vision that it has to keep going. And that's where we would probably, we've seen the downfall in organisations not having that really long-term outlook.

Richard Robinson (14:49):

It's like building bushfire bunkers. I mean, it's entirely impossible and practicable and it's probably another $50,000 when you buy a place in the bush. Maybe it's a good idea.

Gaye Francis (14:57):

But there's some facilities in those bush areas like we've seen at schools and things like that, that do have those in place.

Richard Robinson (15:06):

Well, only after the last <fires>.

Gaye Francis (15:07):

Yeah. But what I'm saying is that has been the change. So what is now reasonably practicable, and there's some organisations, would you put it in for a single house? Maybe, maybe not. But if you're inviting a whole lot of people to a location during bushfire season, then you may.

Richard Robinson (15:24):

Yeah, that's right because you can't ... Well, the program, better not say which school it is, but the program is they'll take the kids out of the edge if there's any kind of bushfire season around, but if they truly get stuck, they have a bunker.

Gaye Francis (15:34):

Correct, correct. All right. On that note, I think we're at the end. Thank you for joining us today, Richard. As we said, there's always a conflict between the moral imperative and the commercial reality.

Richard Robinson (15:48):

The SFAIRP moral imperative and the commercial reality.

Gaye Francis (15:51):

Okay. Thank you for that clarification. But we hope it's been an interesting conversation. Thanks, Richard.

Richard Robinson (15:57):

Thanks, Gaye.

Organisational Safety Culture (Revisited)

Risk! Engineers Talk Governance
Season 6, Episode 6

In this episode, Risk! Engineers Talk Governance, due diligence engineers Richard Robinson and Gaye Francis revisit the topic of Organisational Safety Culture.

They review the work of Professor Patrick Hudson, who identified five levels of safety culture, from pathological (who cares as long as we're not caught) to generative (safety is how we do business around here).

Richard and Gaye observe that many organisations tend to be more reactive, focusing on implementing controls after incidents occur, rather than striving for a generative safety culture. They note that the transition from a bureaucratic, rule-based approach to a proactive, thinking-based approach is challenging, and caution the use of AI, which can lead to a lack of critical thinking.

They end with how organisations should aspire to a generative safety culture, even though it may be an aspirational goal, and highlight the need for clear commitment to safety at all levels of the organisation, rather than just from Board level.

Access the episode’s full transcript below.

Episode transcript

Megan (Producer) (00:00):

Welcome to Risk! Engineers Talk Governance. In this episode, due diligence engineers Richard Robinson and Gaye Francis revisit the topic of safety culture.

(00:12):

We hope you enjoy the chat. If you do, we'd love you to give us a rating. And also don't forget to subscribe on your favourite podcast platform. If you'd like more information on R2A's work or have any feedback or topic ideas, please head to the website www.r2a.com.au.

Gaye Francis (00:32):

Welcome Richard to another podcast session.

Richard Robinson (00:34):

Hello Gaye. Good to be back.

Gaye Francis (00:37):

Good to be back. Today we're going to revisit safety culture. I think we did a podcast very early on (Season 2 Ep 4 & 8) about safety culture and the uprise of James Reason and things like that. But we've just been doing a little bit of research and I guess it comes around some of the observations that we've had that organisations are tending to be a bit more reactive to incidents. And yes, if that incident happens, they're very good at then putting in controls and precautions in place to make sure that that doesn't happen again. But they're not sort of aiming for what we would call that generative safety culture in their organisation. And so you've been doing a little bit of research and a bit of reading, and we've come up with a professor, isn't he?

Richard Robinson (01:25):

Yep. Well, he was, he's emeritus, he's retired.

Gaye Francis (01:28):

Okay. Professor Patrick Hudson.

Richard Robinson (01:31):

Yeah, the trick here, he's been around for a while. The thing I didn't actually quite appreciate was we normally use the James Reason model, and the James reason model has three levels, bureaucratic...

Gaye Francis (01:42):

Pathological first, down the bottom -- shoot the messenger.

Richard Robinson (01:46):

Yep. Bureaucratic -- listen to messengers if they happen to arrive alive. And then generative -- training more people to bring bad news to your attention. And everybody aspires to generative. Now, what I didn't actually quite appreciate because for some reason I've always given the credit to James Reason, was this Patrick Hudson fellow was actually the project manager for Tripod Delta where all this stuff came from. And I must say I've always been a little bit surprised just how much kudos James Reason got out of that Tripod Delta thing -- that was the Piper Alpha (oil rig) incident in the North Sea. But this fellow actually had five levels rather than the three levels. In an overall sense, I don't think we particularly care one way or the other, but he actually had a couple of levels which did actually make us twitch just a little bit. Perhaps you might just read them.

Gaye Francis (02:32):

So I need my glasses for this. Pathological, who cares as long as we're not caught. Reactive, safety is important, we do a lot every time we have an incident. Calculative, we have systems in place to manage all hazards. Proactive, we work on the problems that we still find. Generative safety is how we do business around here. And he's sort of got two arrows around two arrows heading up the page of that. And it's increasingly informed and increasing trust, which I think are two really important attributes that are required in a safety culture.

Richard Robinson (03:09):

Well, I think what we sort of regarded with this is that we're aware that somebody gets the fright of their lives and they're previously smug and happy, which have been the pathological viewpoint. And then what they tend to do is leap to Standards. And if you believe the professor from Brisbane University, the fellow, Sidney Decker, he's the one who says (we've) now got so many rules, nobody knows what all the rules are. Now if you go from pathological to the next level and then go to that calculative one, you're sort of going with the Standards, but you're creating more and more rules. And we keep seeing that. We keep people just creating more and more and more rules and truly the people who've got to implement them really don't know what's going on. So they haven't actually taught the philosophy and they haven't actually gone to the right ideas.

Gaye Francis (03:54):

Which is that sort of that bureaucratic level in James Reason terms.

Richard Robinson (03:57):

Yeah. Most of our clients come to us they're generally at the bureaucratic or slightly better than they're looking for better. They're actually searching for better, which is what he calls is proactive. And I agree with that. It is an interesting thing whether generative is actually aspirational. It's bit like zero harm. I don't think anyone actually believes if you're a large organisation, zero harm's going to be the case. But you would like everybody to try and strive for that. The example I usually give is the police commissioner who's trying to go for zero child molestation. Well, we hope that's the objective, but do you think the police commissioner's got the resources to make that happen?

Gaye Francis (04:32):

To be able to do that.

Richard Robinson (04:33):

So we certainly aspire to that. I think the plan is if you aspire to generative, then in his terms you're more likely to be past bureaucratic and being proactive.

Gaye Francis (04:43):

Yep. I agree. And I think generative is one of those ones that it's almost always changing. The goalposts are always changing for generative. As new technology becomes available, more information becomes available so that generative is always moving that little bit further out.

Richard Robinson (04:59):

Well, one of the things that's bothering us is the rise of AI and everybody sort of... we've noticed a lot of people just adopting AI and stopped thinking, and I have a nasty feeling a lot of people are going to try and use AI for safety purposes. And the one thing I don't think you can do is stop thinking. Thinking's hard. And I've got this bad feeling too, that, well, you are about to mark some assignments, I have no idea whether you're going to get a lot of AI coverage in there.

Gaye Francis (05:25):

See how we go. Well, maybe that's one of the extra lines that has to go up through your page, increasingly informed, increasing trust. But it's increased thinking. Isn't it? Almost required to reach that generative and proactive stage.

Richard Robinson (05:39):

Well, I'm not saying AI can't give you certain insights, but I'm pretty sure the courts are against it. If you're an expert, you better not be relying on AI because we've heard some stories about a lawyer who relied on AI and it just turned out to be complete rubbish because remember, all the AI do is scraping the network or the internet and it's to see what the internet collectively thinks. Well, I've got to say human collective thinking can sometimes be an error as I think we have noticed. And the reason for being an expert is that you're actually something different to what the collective actually believes.

Gaye Francis (06:09):

And you have to really believe what you're saying.

Richard Robinson (06:11):

Not so much to believe. You've got to have a reason to argue for that position. I mean, that's why Kant (philosopher) is so hard to read because it's critique of pure reason. It's hard work, particularly the way Germans sometimes think. But there's some good understanding there. I mean, I've been through the fact of time and space are most likely human constructs and used to sort of recoil.

Gaye Francis (06:34):

Yeah. Some days it hit you that first thing in the morning when you get into work, and that's a bit too much.

Richard Robinson (06:38):

I've got grandchildren, you can see the grandchild bash themselves working out hand, face, don't hit, not good.

Gaye Francis (06:44):

Unless it's your brother or sister.

Richard Robinson (06:45):

Yep. Well, in this case you just poke them at the sharp object if you can.

Gaye Francis (06:49):

Anyway, we've definitely got off topic. So we just think that this safety culture, the concept of safety culture, it's always been there in organisations. It's not talked about as much now than it was in the early 2000s. And we are seeing organisations from our experience moved back down to that bureaucratic reactive sort of stage. And that drive for generative and proactive isn't as forthcoming.

Richard Robinson (07:23):

Well, it's got a lot to do. I mean, from our point of view, I mean it's used of target levels of risk and safety. That to us is the classic bureaucratic position because oh, I've satisfied the criteria, I'm good.

Gaye Francis (07:34):

Done and dusted

Richard Robinson (07:35):

As we've described, if you're at 30,000 feet and it's all going wrong and the Captain says, "oh, we satisfied our criteria, even though we could have done more and we wouldn't be crashing if we had", I don't think that's what people want to hear.

Gaye Francis (07:46):

No, no. You would definitely like your airlines to be proactive tending towards generative.

Richard Robinson (07:52):

And that's why people like to have pilots at the front of the aircraft. The aircraft could land itself now. It's probably more reliable than the pilot, but we do like the pilot to be first at the scene of the accident.

Gaye Francis (08:02):

That's a pretty morbid message. But yes, that that's what it is. So we're just saying there's a lot of information out there. We would encourage organisations to go down that proactive to generative approach because I think you do get better safety outcomes.

Richard Robinson (08:20):

But we wouldn't suggest that you rely on that exclusively. I think that's part of what I have difficulty with some of these psychological models. The belief is if the psychological model is right, everything else flows. I haven't quite worked out that having a proper state of mind means that you are diligent. I don't think those things are necessarily congruent.

Gaye Francis (08:36):

I think what it does give you is though, if everybody understands the culture of an organisation and everybody's contributing to it, it's that thought process that goes through it. But as we've said many, many times, the risk business and due diligence business in the technical organisation, it has many, many facets. And you can slice it and dice it a number of ways to get that insight. But it's one of those elements that does contribute to the overall safety of an organisation.

Richard Robinson (09:04):

But it'd be nice to get everybody to agree that zero harm is a good target.

Gaye Francis (09:07):

Absolutely. Rather than just the Board on a piece of paper.

Richard Robinson (09:10):

Correct. And that wouldn't be what our experience has been. To go for a target level of risk of safety is not a zero harm prospect.

Gaye Francis (09:19):

No, no. And it doesn't help when you have to report your days since injuries, last injury and your LTIs and things like that.

Richard Robinson (09:28):

Yep.

Gaye Francis (09:30):

I think that's about it on this one, Richard. So we might wrap it up. As we said, safety culture is an element that should be thought through from an organisational viewpoint. And there's many authors out there that write about it and characterise it in different ways, and it's just interesting to read some of that.

Richard Robinson (09:48):

Yep.

Gaye Francis (09:48):

So thanks for joining us.

Richard Robinson (09:50):

Thanks.

Safety & Planning Law Complications

Risk! Engineers Talk Governance Podcast
Season 6, Episode 4

In this episode, Risk! Engineers Talk Governance, due diligence engineers & R2A Co-Director’s Richard Robinson and Gaye Francis discuss the complications of Safety Legislation & Planning Law.  

Drawing on their extensive experience across multiple Australian jurisdictions—including Victoria, New South Wales, Queensland, and federal government projects—Richard and Gaye discuss the challenges engineers and designers face when navigating competing legislative requirements. They examine why Work Health and Safety (WHS) legislation doesn't always take precedence in planning decisions, despite common assumptions, and how this creates significant complications for professionals trying to ensure safe outcomes.

Safe Work Australia's Best Practice Review of Model WHS Act & Regulations

Risk! Engineers Talk Governance
Season 6, Episode 3

In this episode, Risk! Engineers Talk Governance, due diligence engineers & R2A Co-Director’s Richard Robinson and Gaye Francis discuss Safe Work Australia's review of the model Work Health and Safety (WHS) Act & Regulations, and R2A’s submission response.  

Key points include:

• Contradictions between the WHS legislation, regulations, and common law requirements, particularly for designers and engineers. 

• Concerns around the hierarchy of controls and how they are interpreted by regulators.

• Inconsistencies in how the WHS legislation is implemented across different jurisdictions.

• Misalignment between WHS legislation and planning laws, creating challenges in integrating safety considerations early in the design process.

The discussion highlights the need for greater clarity and consistency in the legal framework governing workplace health and safety, to ensure effective implementation, especially for designers and engineers.

Submissions closed 3 November 2025.

Access the episode’s full transcript below.

Episode transcript

Megan (Producer) (00:01):

Welcome to Risk! Engineers Talk Governance. In this episode, due diligence engineers Richard Robinson and Gaye Francis discuss Safe Work Australia's best practice review of the Model Work Health and Safety (WHS) Act and Regulations and outline their submission response.

(00:20):

We hope you enjoy the chat. If you do, please give us a rating and subscribe on your favourite podcast platform. If you'd like more information on R2A's work or have any feedback or topic ideas, please head to the website www.r2a.com.au.

(00:38):

Tickets are also still available for our live forum in person and online on 21st of October, 2025. You can find the link in this episode's description.

Gaye Francis (00:50):

Good morning, Richard. Welcome to our podcast session.

Richard Robinson (00:53):

Good morning, Gaye. Welcome back.

Gaye Francis (00:54):

Thank you. It's been two weeks of school holidays, so it's nice to be back.

Richard Robinson (01:01):

I'll mention this to your kids the next time I see them.

Gaye Francis (01:04):

True, true. Straight into it today. What we're going to talk about today is Safe Work Australia has a discussion paper out titled Best Practice Review of the Model Work Health and Safety Laws - Discussion Paper dated September, 2025. And they're asking for submissions till the 3rd of November (2025). And of course, R2A can't help itself, but we need to respond to these sort of things.

Richard Robinson (01:28):

Particularly since there are some glaring contradictions and in so far as we can tell from the point of view of designers, Section 22 of the WHS legislation or section 28 if you happen to be in Victoria, which requires the SFAIRP application. And there has been quite really categorical contradictions, which we've never quite understood. And one would hope that Safe Work would be willing to have a crack at the legal framework to try and fix these things.

Gaye Francis (01:54):

I was just going to say that the key questions for this sort of best practice achieves the object of the Model WHS Act section three within this context, how do we maintain best practice in response to the changing nature of work and emerging risks? And how can harmonisation of WHS laws be strengthened and maintained across jurisdictions into the future? And I think getting that consistency across a whole lot of things, and we've sort of got three key points and we might go through them. We'll go through 'em today.

(02:22):

It's really that the Act versus the Regulation and the Code of Practice.

Richard Robinson (02:28):

Correct.

Gaye Francis (02:28):

And there's a contradiction there, and we'll go through that in a little bit more detail. I think there's a huge mess around the hierarchy controls of what's in the legislation compared to the common law and then what the regulators are promoting.

Richard Robinson (02:42):

Correct.

Gaye Francis (02:43):

And I guess we've come from it from a practical viewpoint of a practical implementation of the WHS legislation, especially for designers and engineers. And that sort of leads on to what you were saying before about the designer section, Section 8.

Richard Robinson (02:59):

Well, the other one is the basic non-alignment of planning law with WHS legislation, which has got us confused as engineers. And then as far as I can tell, the lawyers aren't clear on it either.

Gaye Francis (03:19):

So I think you've given the introduction of the contradictions for the designers and the requirements of designers. And so I guess the next one is the contradiction of the Act and the Code of Practice in particular.

Richard Robinson (03:37):

This is one which keeps emerging. The Code of Practice follows pretty much the Risk Management Standard. So I'm just going to look at the little diagram that the most recent one puts out. And it says Identify hazards, assess risk, control risks, and review risk controls. And that pretty much follows the Risk Management Standard, which so far as we can tell, doesn't follow the process that you need to in order to survive Common Law scrutiny and presumably statutory.

Gaye Francis (04:00):

And when we say assess the risk, we are talking about consequence and likelihood, aren't we?

Richard Robinson (04:04):

Correct. By risk assessment? So you can have high consequence, low likelihood to be low risk still.

Gaye Francis (04:09):

Yes.

Richard Robinson (04:10):

Despite the fact that something really nasty. So it's high consequence, low likelihood could still occur. Now the way we always do it, and we've tested it for so many lawyers, it really sort of got to the point that you, yeah...

Gaye Francis (04:24):

We're not quite bored with it, but it is going down that path.

Richard Robinson (04:28):

But our recommendation is you follow what we understand to be the Common Law approach, and that is you identify the credible critical ones, the ones that can kill the maim, then you identify the further possible precautions that could be put in place, and then you work out what's reasonable in the circumstances based on what you know, which then is supposed to be an objective test. And then you have a QA system to make sure that what you've agreed is sustained. Now that actually contradicts the Risk Management Standard approach very thoroughly.

Gaye Francis (04:55):

And some of the commentary that goes with that, it's sort of for known hazards. If there's known solutions, you just put those in place. But what we're saying is the SFAIRP principle actually asks you to look at all of the controls that could be put in place.

Richard Robinson (05:09):

Correct. For the critical ones.

Gaye Francis (05:10):

For the critical ones, and then determine what are reasonable in the circumstances. So that might be more or different to the ones that are already in place.

Richard Robinson (05:18):

And it may well be different to what's in a Standard.

Gaye Francis (05:21):

Yes. So you just have to be careful there that you're not just doing what everyone else does or what's common practice. It may not be relevant in the circumstances.

Richard Robinson (05:33):

Correct. And it will be the judiciary that decides what's relevant in the circumstances. I mean, the way it actually works, I mean something bad happens, somebody gets killed or maimed, it goes to court, or the expert pop up after the event, and say, with the advantage of hindsight, what could have been done, which isn't that hard. And then the court decides in all the circumstances whether the ideas dreamed up by the experts were sensible in view of what was known at the time the decision was made.

Gaye Francis (05:59):

That is, were they reasonable?

Richard Robinson (06:01):

Yep.

Gaye Francis (06:03):

So yes, that's probably the first one and we are putting that in our letter. The next one for me, and this is the one that probably annoys me the most, is the hierarchy controls and the different commentary that's going around about those, and especially from regulators. So we've covered this many times. The WHS legislation has a hierarchy of two. You must eliminate first, and if you can't eliminate, you can reduce it, so far as reasonably practicable. When you go to court, it's divided into three categories. Elimination, prevention, you stop the thing from happening and then mitigations, which stops the escalation of the consequences or reduces the consequences.

Richard Robinson (06:44):

And the example you usually give us is of the rail road crossings level crossing. So obviously if you want to eliminate, you can grade separate at great expense or you can put up boom barriers, which will stop the incident from happening at all. And if that fails, you go with crashworthiness, all of which happen to be engineering controls, and which engineering only pops up typically as one out of six controls that most regulators put up.

Gaye Francis (07:07):

And that's probably the other area is that how regulators do it. And we've seen 'em everything from three to four to seven sort of categories.

Richard Robinson (07:19):

Well, different jurisdictions have different things, but the most popular one seems to still be six with eliminate being the top and then another five. But Victoria's down to four I think. And sometimes you're seeing Queensland, they've got both six and three. It's very confusing if you're a designer as to which one you're supposed to use.

Gaye Francis (07:35):

And they've also grouped some of them together. So isolation, engineering and substitution.

Richard Robinson (07:41):

Well, that's how they shrink it down. What's interesting from our point of view is they're getting closer and closer to what we understand to be the way the courts go about it. But for some reason...

Gaye Francis (07:50):

The terminology is not the same though. And I think that's where it's confusing. So I think to harmonise the WHS legislation, if the regulators could get on board of what an agreed...

Richard Robinson (08:01):

It would be really helpful the regulators would talk to Safe Work Australia, I think.

Gaye Francis (08:04):

Yes. And streamline that process. I think that would take a lot of confusion out for engineers. And the third one is probably Richard's favourite part at the moment, is the planning legislation.

Richard Robinson (08:16):

Wouldn't call it favourite!

Gaye Francis (08:19):

Or the area that's causing the most difficulty and confusion is the planning laws and WHS legislation.

Richard Robinson (08:26):

Yeah. Because what seems to be happening is that planning law basically has a life of its own, unless there's some forced connection between WHS legislation seems to be ignored. I mean, probably the one that hit us the hardest, and that I've got to say practically was when we did the hazard and risk analysis for Western Sydney Airport because we didn't start the job until we got the Australian government solicitor to agree that the owner and operator at the airport had to comply with the WHS legislation. But then when the planning process went through, we sort of got told, well, you don't have to follow the legislation for the EIS. And that's really weird because most of the core hazards are set up right at the start of the planning process.

Gaye Francis (09:01):

Well set up, but also able to be dealt with at the most, at the easiest part on a pen and paper and a planning stage than it is once it's been implemented.

Richard Robinson (09:12):

Yeah, no, I think we've already spoken about it, so I don't propose to go into it here, but the only time when we've found a good connection between the two is when the planning law has a requirement that advice needs to be received from the relevant regulator, for example, major hazards, in which case the planning system actually does take cognizance of the obligations. But then it's more the obligations.

Gaye Francis (09:34):

Only if it's brought up though.

Richard Robinson (09:36):

That's correct. It has to be forced into the system somehow. And in that sense, in Victoria, the VCAT one we're talking about, the council had to actually ask the opinion of the WorkSafe Victoria with regards to a major hazard facility. WorkSafe Victoria presented an opinion, therefore that opinion then had to be thought about.

Gaye Francis (09:54):

Yeah. And I am sure there's other legislation that would have conflicting requirements as well, but that's the one that we've sort of come across.

Richard Robinson (10:05):

Yeah, they're the three sort of biggest that we've come across, which obviously we're going to advise. And for those of you who are contemplating coming to our October (2025) event with regards to SFAIRP, these sort of questions will pop up there possibly depending on what people ask.

Gaye Francis (10:24):

Yeah. And the discussion will sort of be around these things. So I think as we said before in our podcast, we're not actually sure what the event will turn out like and what discussions will be had.

Richard Robinson (10:35):

We're pretty sure it's the questions that are going to be the best part.

Gaye Francis (10:38):

The discussion part will be the best part. And I think some of these things that we've been talking about, there's no one answer to do it, but there's ways and people think about these things differently. And I think that's the important part that these difficult conversations are being had.

Richard Robinson (10:54):

Well, it is essentially, if you look talking the larger thing, I mean the WHS legislation was attempting to get societal alignment from problems that arose since Federation, big step forward. But it went to the highest level, the parliamentary level. And even Victoria still has to put in the adopted it, even though we have the SFAIRP business, we don't have the due diligence business, but we've certainly got all the obligations and designers that's pretty much the same. But then the next level down in effect is what we're actually talking about. And that harmonisation hasn't happened properly yet, which is what Safe Work is actually asking for.

Gaye Francis (11:27):

And I think if anyone was interested in going through that discussion paper, it's actually a good read and they've sort of put the differences between the different jurisdictions. So even though you've got a model WHS Act.

Richard Robinson (11:39):

You haven't got the regulators harmonising themselves yet.

Gaye Francis (11:41):

So there's some harmonisations and there's been a number of tweaks to the legislation that makes each jurisdiction that just that little bit different from each other. So they're sort of saying, is there some consistency that can be thought through?

Richard Robinson (11:56):

We don't know what motivated this particular best practice request. We have some suspicious that the points we're making may be relevant.

Gaye Francis (12:05):

Yes. So I hope you found today's podcast interesting. Thanks for joining us, as always, Richard, and we'll see you next time.

Richard Robinson (12:12):

Thanks Gaye.

Target Levels of Risk & Safety: SFAIRP vs ALARP Revisited

Risk! Engineers Talk Governance
Season 5, Episode 6

In this episode, Richard Robinson and Gaye Francis revisit the distinction between SFAIRP (So Far As Is Reasonably Practicable) and Target Levels of Risk and Safety.  

They explain how target levels of risk continue to be problematic in engineering despite being legally unsupportable under WHS/OHS legislation and share examples of regulators and engineers still using outdated approaches and discuss why this confusion persists, pointing to issues with Standards and educational institutions that continue teaching these methods.

They clarify that SFAIRP asks "Are all reasonable practical precautions in place?" while target based approaches rely solely on calculated risk levels. Through real-world examples including expert witness cases and engineering consultations, they demonstrate how the SFAIRP approach leads to better safety outcomes and alignment between stakeholders and warn engineers and organisations still using target levels of risk for safety issues. 

This conversation follows their original discussion in Season 1 Episode 1: SFAIRP vs ALARP.

While the table they refer to is available in their Criminal Manslaughter – How Not To Do It booklet.

Richard and Gaye also run public and in-house workshops on the topic.

Access the episode’s full transcript below.

Episode transcript

Megan (Producer) (00:00):

Welcome to Risk! Engineers Talk Governance. In this episode, due diligence engineers Richard Robinson and Gaye Francis revisit the topic of target levels of risk and safety.

(00:13):

We hope you enjoy the chat. If you do, please give us a rating and subscribe on your favourite podcast platform. If you'd like more information on R2A's work or have any feedback or topic ideas, please head to the website www.r2a.com.au.

Gaye Francis (00:33):

Hi Richard, welcome to our podcast session today.

Richard Robinson (00:37):

Good day Gaye. I'm glad I'm over. I can tell you that

Gaye Francis (00:39):

I'm glad you're over Covid. You're thinking a bit better now. So that's always a good thing.

(00:44):

Today we're actually going to revisit one of our topics that we've talked about in the first season (Season 1 Ep 1) I think it was, and it was around SFAIRP and ALARP. So this one's titled Target Levels of Risk Revisited. And I guess the reason for revisiting it, it's that it's had over 200 listens on the podcast for the previous one, but we are finding more and more that target levels of risk and safety are still causing problems and still being called up and still being used and even more so I think now than they have in the last five years.

Richard Robinson (01:23):

But the consequences of this is that all these other parties are turning up to talk to us, to actually ask us to do more to overcome it. And by that I mean for example, we just had a regulator from New South Wales where a lot of the stuff seems to be based sort of wanting us to actually come and give a paper or presentation to their regulator, their conference, about why you ought not to be using the hazard and risk-based approach within SIL allocation processes, which is something we've talked about at a great length. And then we had also another visitor from another state regulator and they want us to act as the peer reviewer for the registration of fire engineers. And in particular they want us to make sure that everybody understands as a fire engineer that it's all being driven by the provisions of the WHS/OHS legislation, which a law fire engineers still don't seem to grasp and still want to keep using target levels of risk and safety. And then more than that, we then had an engineer from Western Australia pop up and I'm really literally talking about the last three weeks I suppose.

Gaye Francis (02:24):

Correct.

Richard Robinson (02:26):

Basicly explaining how EG-0 which uses target levels of risk and safety, it's completely unsupportable and which, so far as his concern had been overturned in the state in which he lives, has suddenly made a reappearance. And we're sort of saying this is peculiar because the serious players saying don't do it. And yet for reasons that we don't understand, it keeps coming back.

Gaye Francis (02:49):

I think it goes down to, and another topic that we'll probably talk about in this season, is that silo work and people doing things in silos and not understanding the overall context and the high level context as you said, that the WHS and OHS legislation really runs anything to do with safety.

Richard Robinson (03:08):

Correct. And it drives it. I mean we don't get it because I mean we live in a democratic society run with the rule of law and our parliaments actually do decide, and there was this contest of ideas, and they did adopt the WHS legislation with criminal manslaughter provision I might point out, as well as the peculiar duties on designers and the Section 22. And it basically hammers it forever. We just don't simply understand why engineers in particular don't seem to grasp this point.

Gaye Francis (03:37):

It's probably worth just giving a brief overview of what we mean by SFAIRP and target levels of risk and safety and the difference between the two.

Richard Robinson (03:46):

Well, we've been observing that ALARP is mutating into SFAIRP that the bit that's not mutating properly is the target levels of risk and safety. And this notion that risk assessments of themselves will provide you with an answer and describe why you don't have to do any more and that's just patently incorrect.

Gaye Francis (04:03):

So for us, the basis or the difference between the two are the SFAIRP principle says: Are all reasonable practical precautions in place? And the target level of risk and safety says that a calculation has been done based on consequence and likelihood and then that's as low as it can be. So that's sort of the two ideas that we think that there is a difference. And as you said, the principles around ALARP have been mutating into different things and they're sort of now asking the question, well even if the risk target is this much, can we do anything more?

Richard Robinson (04:43):

Yes.

Gaye Francis (04:47):

But really we're talking about SFAIRP and target levels of risk and safety.

Richard Robinson (04:52):

And I think we've basically decided we're going to stop talking about ALARP per se and just don't keep talking about target is risk and safety, because that's the path that fails. And that's the path that the risk management standard keeps encouraging. And I guess that's why we think people keep adopting it. I actually think an awful lot of this has got to do with Standards Australia, which we've already sort of talked about, and the fact that for reasons that we don't understand, Standards Australia haven't been picking up their game. It's got a lot to do with the fact, and again, one of these engineers asked about EG-0 that's endorsed by ENA, the Energy Networks Australia organisation, no liability seems to be being assigned back to the authority that's endorsing these things.

Gaye Francis (05:33):

Okay.

Richard Robinson (05:34):

Now I dunno legally whether that's actually the case because it was the question I was being asked and I'm not law enough to answer that one. But it does seem to me that if the reason why that people are still using target levels of risk and safety is because either Standards Australia either inadvertently or deliberately let it happen or in the case of Energy Networks Australia, they deliberately let EG-0 continue in the way that it's been going. We simply don't get it. I mean I can distinctly remember this is sort of one of these weird things that I was giving briefing to one of the boards, I better not say which one, but one of the distribution boards about the limitation of target levels of risk and safety and why he couldn't use EG-0, and when I stepped out the back, the fellow who drafted EG-0 was actually running a course on the subject. What I was doing was briefing the board with the support of the legal counsel for that organisation and yet the engineers were being taught at the back to go and use target levels of risk and safety at the same time. Now you sort of look at that and say, how is that possible?

Gaye Francis (06:32):

And you wonder why engineers are confused.

Richard Robinson (06:34):

Correct. Because they're being taught it.

Gaye Francis (06:36):

Yep.

Richard Robinson (06:37):

I remember I told you I was one of the defense engineers, I was busily explaining the difference between the two, and this bright young female engineer was looking at me said: I only finished university last year and they were teaching the risk management standard and target levels of risk and safety. I sort of went, yeah, it's a bit hard when the whole system or part of the system continues to teach it like it's a science when it simply doesn't pass the test.

Gaye Francis (07:01):

I think when the WHS legislation came in, we were in a conference or in a meeting and regulators give advice and so unless it's called up by legislation they can't be held accountable. Was that the way it was with standards as well? Because you said because the liability is not going back to the people that are putting out the standards, I guess their guidances, aren't they? And then you've got to really sit back and have a look at it and see whether it's relevant and applicable to what you're doing.

Richard Robinson (07:33):

But that was part of the point about the... Remember that quote from that lawyer from Minter Ellison about regarding AS 7000 and he's pointing out, now unless the standard's called up by statute of regulation, which they're pretty much not anymore, it only amounts to expert advice, but an engineer still has to exercise his or her skill and expertise irrespective of what the standard says. And what that was all about. I mean, I sort of explained this before with standards have two purposes: Preventing fools from their follie and rogues from their roguery because what you're supposed to do is figure out how it ought to be and then you go, and that's a design issue that's got nothing to do with target levels of risk and safety. You're saying right in the circumstance for this particular problem, what's the best solution?

(08:16):

You might recall again for the electrical company I was talking about, we were doing that review on the sub-station, which was next to the train lines and we were trying to figure out, because when you get earth return current, you've got obviously rail tracks going next to it you've got the ability to transfer high voltages and currents over a long distance when you've got steel rail tracks nearby is actually quite relatively easy even though it's an unlikely thing. And in the end, after we went through the process and this was following the provisions of the WHS Act, well in that case, the same SFAIRP principle as it was contained in their revised Electrical Safety Act, they basically sold the site and moved far enough away that the earth return currents couldn't affect, or the railways couldn't be part...

Gaye Francis (08:56):

So they couldn't put enough controls in place or precautions in place to allow it or determine it to be SFAIRP.

Richard Robinson (09:03):

Well you had to eliminate if you could. And the short answer was we could sell the site and buy the another one down the road and it was the cheapest way to fix it.

Gaye Francis (09:09):

So that comes back to my line, doesn't it? The difference between the two is target levels of risk and safety asks: Is this bad enough that we need to do something about it? Whereas SFAIRP is saying, here's a good idea, why wouldn't we do it?

Richard Robinson (09:21):

Correct. And the target of risk and safety is basically pathological in James Reason's terms, "here's a good idea", that is the objective of the legislation. The highest level of control as is reasonably practicable.

Gaye Francis (09:35):

And I think though, the key reason we keep pushing the SFAIRP principles is that we do give expert witnesses. Richard's doing an expert witness case at the moment and the opponent's argument is around target levels of risk and safety that it's really so low that we don't have to worry about it and where there's good ideas that can be put in place and so the court is going to test it.

Richard Robinson (10:04):

Well, it's going to be absolutely fascinating because one of the other things. You know we've got that little table (Criminal Manslaughter Booklet p24) and we when we run the course, we sort (show) the advantages and disadvantages between the two approaches and the solution-based approach, which is looking at here's a good idea, everybody comes together to look for it. Whereas when you do the hazard and the risk stuff, it devolves into detail. Everybody gets lost. And I can tell you the lawyers and the barristers are very lost in a whole lot of technical. Part of the problem is when you're going from what's the molecular weight of something and most times that's expressed in grams per mole, but a lot of people want to express it in kilograms per kilo mole. Well at this point, I'm not sure the court's basically with us in the discussion!

Gaye Francis (10:51):

And the numbers have been changing as well depending on what the circumstances that you're going to base your calculation on. So for us, we've always said that the WHS legislation/OHS legislation requires SFAIRP. ALARP as a term is still being used, but it has mutated into something that it wasn't. But R2A are really against and you can't use target levels of risk and safety to deal with safety issues.

Richard Robinson (11:22):

Correct. And I suppose just sort of a final point, I mean you may recall last year we did that review in that tall building and we had two sets of lawyers, one for the underwriter, one for the body corporate, and there were two sets of fire engineers and a lot of damage that occurred and what the underwriter's willing to pay for and what the body corporate thought should be the case, they were heading towards a court case.

(11:49):

And the last chance I think was when they got the couple of due diligence engineers and we ran a workshop and we explained the provisions of the WHS legislation and the lawyers looked at each other and said, yes, that's right. And then the fire engineers whom they've advised us afterwards, were getting ready to walk because they weren't going to sign off on the solutions that were being suggested, I think by the other party there were two sets. Once the WHS legislature was evoked, everybody aligned and the fire engineers said, thank goodness for that, we can sign off on the solution that's resulting.

Gaye Francis (12:25):

It was working towards a solution that everybody agreed to, wasn't it?

Richard Robinson (12:29):

And that's just hammering the point. There's no such thing legally, so far as we know as a risk assessment, it's a risk design assessment and that's where people seem to get it wrong. And I do not understand why that part, you would've thought the engineers would've thought design. That's us.

Gaye Francis (12:45):

It's a lot easier to do as well.

Richard Robinson (12:48):

The other options are just appalling. And I've just watched as this case, it was meant to be finished a few weeks ago and it got deferred. So more risk assessment work could be done. And I don't think it's going to help the court at all, but I'll find out soon.

Gaye Francis (13:02):

You will find out in a week's time.

(13:05):

So we just wanted to revisit that subject today, target levels of risk and safety and the SFAIRP principle, try and explain the difference between the two, and hopefully just give you a bit of a heads up that if some of your standards are still using target levels of risk and safety, be really careful, especially around safety issues.

(13:24):

So thanks for joining us today, Richard, and we'll see you next time.

Richard Robinson (13:28):

Indeed.

Due Diligence in Marine Pilotage

Risk! Engineers Talk Governance
Season 4, Episode 6

In this episode, Richard Robinson and Gaye Francis discuss the application of due diligence in the Marine Pilotage industry. 

They discuss various consulting work they’ve done with Marine Pilots across Australia and New Zealand ports, and summarise the key take-away that the process is no different for pilotage due diligence reviews than any other (industry’s) due diligence review. 

That is, 

• There needs to be an argument as to why all the credible critical issues have been identified. 

• In a port, they typically look at all the user groups and what activities they're doing. 

• Look at all the controls that can be put in place, which are reasonable in the circumstances. 

• Always needs to be a quality assurance system to make sure that what is being put in place are sustained and managed accordingly. 

But, noting, there will be site specific or port specific issues so the controls put in place may be different.

Access the episode’s full transcript below.

Episode transcript

Megan (Producer) (00:01):

Welcome to Risk! Engineers Talk Governance. In this episode, due diligence engineers Richard Robinson and Gaye Francis discuss the application of due diligence within the marine pilotage industry.

(00:16):

We hope you enjoy the chat. If you do, please give us a rating and subscribe on your favorite podcast platform. If you'd like any more information on R2A's work or have any feedback or topic ideas, head to www.r2a.com.au.

Gaye Francis (00:34):

Hi Richard, welcome to another podcast session.

Richard Robinson (00:37):

Good morning, Gaye.

Gaye Francis (00:39):

We thought we'd focus on marine pilotage today because during this season, we were going to cover some of the industries that we do some work in. So you're actually giving a presentation next week (October 2024) in New Zealand in Christchurch to the New Zealand Marine Pilots' Association.

Richard Robinson (00:55):

Indeed.

Gaye Francis (00:55):

And we've done this on a number of occasions and for a number of courses both in Australia and New Zealand. So I guess, do you want to sort of have a quick run through your presentation... What you're going to cover in your presentation.

Richard Robinson (01:11):

Well, it hasn't been totally confirmed yet, but I'm following Antonio De Lito, who's an Australian Italian, and I suspect he's going to be talking about the incident of the Joly Nero that took out the control tower in Genoa and certain people got killed. Now that was about six/seven years ago now, I think it is. And as a consequence of all these deaths, and it was a litany of disasters and confusion and things that went wrong between the marine pilot and the ship's engineers and the captain, in part because certain bits of equipment weren't working, i.e. the engine rev counter wasn't working, so the pilot didn't realise quickly enough, they were relying on voice messages between the engine room and the captain as to where the actual state of the engines were. But anyway, the control tower got took out. And strangely enough, the Italian courts adopted this notion of due diligence, which I didn't think was a civil lawy, European-type Roman law, not polyonic law concept, which I thought was a peculiarly common law, English speaking world idea. But they applied it and as a consequence they put the captain away, the chief engineer away, they tried to put the marine pilot away, but he got off on appeal and now they're having a crack at the engineer who put the control tower on the point such that if a ship...

Gaye Francis (02:32):

Did fail in any way...

Richard Robinson (02:34):

It could be taken out. And I don't actually know where that's gone. I'm sure Antonio will give us an update, but I was going to explain the due diligence aspects of that. Now, we've been through this before and for numerous things, and we've explained it with regards to the Lake Illawara and the incident at taking out the Hobart Bridge. And you might recall the Cosco Busan, which hit the Golden Gate Bridge. See, marine pilots have a lot of protections under civil law, but when something bad happens, there's an increasing tendency, we sort of talked about blame culture, which has popped up this decade in particular, when something goes wrong...

Gaye Francis (03:07):

Whose fault was it?

Richard Robinson (03:09):

Yeah, whose fault was it? Well, in that particular instance, despite all the sort of legal protections that the marine pilot in San Francisco had, they put him away under environmental legislation for coating birds with oil. So there's always something can come out and get you, if they want to get you, they'll come and get you these days.

Gaye Francis (03:32):

There's a whole lot of different legislations that apply.

Richard Robinson (03:35):

And it'll be interesting to see. You remember the Boston Bridge got taken out by a ship that went blacked out, and the question was why didn't it have a tug? Because that's the whole point of having tugs. If you know there's something you could take out, you have a tug tied fast the stern so that you can be steered out of the way with the momentum of the ship. So just because when it blacked out, there's nothing that can do. The ship's going to go wherever the ship's pointed or whatever the circumstance, the current and the wind and everything else just pushes you to, that's where you're going to go until you just stall or you drop your anchor and it's going to come to a grinding halt or whatever you've done, but you don't have any choice. And so all this sort of stuff is basically reappearing. And the job is to make sure that for all the credible critical scenarios, you've got measures in place so that really bad things don't happen, such as hitting the Golden Gate Bridge or taking out the bridge in Boston or taking out the control tower in Genoa.

Gaye Francis (04:23):

And I think that's some of the feedback from the marine pilots when we've done jobs for them, is by using the due diligence approach, it actually allows them to get additional resources and the things that they need in place to make the passage safe. Because the things that they are dealing with are high consequence, very, very low likelihood events. And when they were used to do it on a risk basis, it never got over the line.

Richard Robinson (04:44):

Because you discount the high consequence things by the unlikeliness of the event. Well, you might recall when we had those discussion with the world's largest port of Port Hedland.

Gaye Francis (04:52):

Yes.

Richard Robinson (04:52):

And they did the N -1. We're just borrowing an idea that from the electrical industry. The electrical industry basically says that for any network, should a major conductor fail, the system should ignore it - it should just be able to keep going. But we've noticed because of commercial pressures, the headroom is getting tighter and tighter. And I don't think a lot of networks do have N -1 anymore. But when we're talking about that with regards to ships, because we listened to them for about a morning I think, it was marine pilots talking about it, and we just sort of said, hang on a minute, you need an N minus one argument so that if the engine of the ship fails or one of your tote fails, you've still got a way to bring whatever the situation is home safely. And once they did that, they instantly got another tug applied that obviously bolted off to the, well, I suspect the boards of the large mining companies that use that port. And the idea that you could block a channel with a ship which is now Australia's, well, it's the world's largest by tonnage I believe, port.

Gaye Francis (05:46):

Okay.

Richard Robinson (05:48):

What would happen to Australia if you blocked that port, you had to cut the ship up for six months. It just doesn't bear thinking about it.

Gaye Francis (05:54):

And I think that's what it is, it's that the high consequence, as you said, it's the recovery time as well. And being able to block a channel in a port so it can't be used for a long period of time was unacceptable.

Richard Robinson (06:08):

Well you might remember when the Iron Baron hit the Hebe Reef in Bass Strait, the harbor master wouldn't let it be dragged into Devonport just in case it got suck in the channel and just blocked up the ferry service from between Tasmania and Australia. Because if we do that, it becomes impossible for I think one third of all of New Zealand's exports and imports go through by the ferry, by Davenport.

Gaye Francis (06:33):

So again, criticality argument, and that's how it's been applied to marine pilotage. And I think one of the interesting things, and it's being extended to the port scenario now, so pilotage is one aspect of port operations and an important aspect. And so we've done a number of pilotage reviews for a number of ports around Australia.

Richard Robinson (06:54):

You've got to go to think about a marine pilot. The whole point about having marine pilots is for the critical, don't collide or ground a ship. Okay. It's always critical. That's the only reason why the marine pilot's there.

Gaye Francis (07:06):

Well, it's sort of interesting. They're almost the control in a way, aren't they.

Richard Robinson (07:09):

They are.

Gaye Francis (07:10):

So they've got to have the tools available to them to make sure that they're an effective control.

Richard Robinson (07:14):

Correct.

Gaye Francis (07:15):

So some of the controls that we do put in place to make sure that they've got the right information and additional tug services or assistance and that sort of stuff is all the things that they need to do their job effectively.

Richard Robinson (07:28):

Correct.

Gaye Francis (07:29):

What I was going to say though is that sort of idea is now being expanded out into the whole of port scenario. So it's not just being considered for ships being brought in and out, it's actually for the port operations as a whole.

Richard Robinson (07:45):

Are you trying to describe the recent job we did for Tasports, are you?

Gaye Francis (07:49):

Yes. Well we have done it there, but we've done it at other ports as well. But I think one of those integrated approach, and we sort of touched on it in one of our other, previous podcasts is that integrated approach and not looking at some of the activities in silos will give you a different set of precautions than you would if you just did it in silos.

Richard Robinson (08:08):

Well, that was what we did - one of the Tasport's port. They had a whole lot of industry around, and when you looked at the emergency services that those industry had available, and they were more than willing to help and share and provide their emergency services to the port as a whole, then not just for their own purposes. And as long as you had a sort of mutual aid process. But the advantage was that particular port therefore had more resources than most other ports already available to it.

Gaye Francis (08:34):

So by looking at what you could bring in and the controls that you could put in place to address the issues, all of a sudden you've got to a step level improvement in safety that you might not necessarily have got.

Richard Robinson (08:46):

Well, remember there were two Australian subs that turned up in port, Dechaineux and Rankin turned up, and you don't normally see two Australian subs in one place.

Gaye Francis (08:54):

It was pretty exciting, wasn't it?

Richard Robinson (08:55):

We've only got a few of them and only some of them six and only four probably operational at any given time. The rest have always been worked up and fitted out, refitted and things like that. To see two of them in one place at once. It's quite remarkable.

Gaye Francis (09:07):

I'm not sure how to look at the safety due diligence of the port, but considering all the activities that have to be considered.

Richard Robinson (09:16):

That's correct. And remember there was an ill sailor, they had to get off. And the port actually used the collective resources to actually make it a success.

Gaye Francis (09:26):

Okay, you've got to put that bit in, and I had forgotten that little bit. <laughs>

(09:34):

So our process is no different for pilotage due diligence reviews than any other due diligence review that we do. So we need to have an argument as to why all the credible critical issues have been identified. And in a port, we typically look at all the user groups who they're using there and what activities they're doing. So there's an activities table that you do.

Richard Robinson (09:59):

Yeah, it's like the Twilight Regattas in Hobart. There's all these kids and dinghies running around, you better make sure the big ship in an emergency doesn't run over some <people>.

Gaye Francis (10:09):

Yeah. You then got to look at all the controls that you can put in place, which are reasonable in the circumstances. And then, as I said, you're always a quality assurance system to make sure that the things that you are going to put in place are sustained and managed accordingly. But there will be site specific or port specific issues. Like Richard said, the regattas in Hobart were a particular issue. There's more industry in Bell Bay and in Port Headland for example, there's different weather conditions depending on whether you're on the east coast or the west coast of Australia. So there there's different issues and slight variations in each of the ports and the controls that you'll put in place may be different.

Richard Robinson (10:52):

Indeed. Well, you do the best with what you have available to you. And obviously if you can't get there, then you're going to have to do some extra things. But an awful lot of time, and that's certainly, we've talked about tower partners, other things like that. Competent people do competent things. And so if you've got competent people around, they'll be providing services even if you are not aware that that's available to you. Well, in fact, in all the ports we did, we got all the users together. Remember that was the whole point of the exercise. It's hard to do this stuff in isolation and just have a single expert come in and get it right when you've got multiple potential users and multiple potential resources.

Gaye Francis (11:27):

And I think that was the key thing that came out of it, wasn't it? That there were more resources available than was known by any one party.

Richard Robinson (11:35):

Correct.

Gaye Francis (11:36):

That all of a sudden, if you adopted it collectively for the port use overall, then you got that improvement.

(11:46):

I guess that's a summary of what we're going to talk about at the conference next week (October 2024). So good luck with your presentation, Richard, and thank you for joining us.

Richard Robinson (11:58):

Thank you.

Code of Practice & WHS/OHS Confusion

Risk! Engineers Talk Governance Podcast
Season 3, Episode 6

In this episode of Risk! Engineers Talk Governance, Richard Robinson and Gaye Francis discuss Code of Practice and WHS/OHS confusion in relation to a presentation they delivered to the Dam Owners and Operators' Forum in Queensland recently, called "How do we do ALARP? Meeting a duty of care." 

They explain how the Code of Practice doesn’t align with WHS/OHS legislation and if you conduct an “augmented ALARP” as suggested by the ANCOLD (Australian National Committee on Large Dams) Guideline it does not promote innovation or an efficient due diligence process. and that this exists in a number of industry guidelines.

They also discuss the Oroville & Edenville Dam breaks (USA), how risk is multidimensional, how many industry guidelines have the same issues, and considering reciprocity as part of diligent decision making.

Access the episode’s full transcript below.

Full transcript

Megan (Producer) (00:00):

Welcome to Episode 6 (Season 3) of Risk! Engineers Talk Governance. In this episode, due diligence engineers Richard Robinson and Gaye Francis chat about Code of Practice and WHS confusion.

(00:15):

If you have any feedback or topic ideas, please do get in touch via email admin@r2.com.au. And don't forget to subscribe on your favourite podcast platform and to give us a rating.

Gaye Francis (00:30):

Hi Richard. Welcome to another podcast session.

Richard Robinson (00:33):

Hi Gaye. Good to be back.

Gaye Francis (00:35):

Today we're going to talk about the Code of Practice and WHS/OHS confusion and it's sort of in relation to a presentation that we delivered last week to the Dam Owners and Operators' Forum for the Queensland regulator. There were four presenters, and our topic was "How do we do ALARP? Meeting a duty of care."

Richard Robinson (00:58):

And that was with particular regard to the ANCOLD (Australian National Committee on Large Dams) guidelines. And the regulator we're speaking of was the Dam Safety Regulator in Queensland.

Gaye Francis (01:04):

Correct. Thank you. Thank you for that clarification.

(01:08):

So do you want to just run through quickly the difference between the Code of Practice and the WHS/OHS requirements?

Richard Robinson (01:14):

Yeah, because one of the things we realised about the ANCOLD guidelines, they're trying to do two things and we actually suspect those two things at one level are being mandated by the way in which our system set things up. Although we would disagree with the sequence in which you do them.

(01:28):

Now, the first is the WHS legislation. It basically says identify the credible critical issues, identify all the possible practicable controls, in the circumstances work out what's reasonable, and then do that.

(01:41):

The Code of Practice, which has gone through a parliamentary process and is therefore mandated at another level and purports to represent an implementation of the WHS legislation says: Identify the issue. If for known issues, you can just put in recognised good practice. But if you don't know, then you've got to assess the risk before you start looking at the controls, which is the inverse of what the legislation actually calls up.

(02:07):

Now our interpretation of the ANCOLD guidelines is it's basically saying, look, we want you to do in effect what we would call the old way of doing risk assessment, likelihood and consequence, and potentially comparing out the criteria. And then you go do the second process, you say, right, it doesn't matter what the criteria say, is there anything else we can do? So we would tend to refer to that. I think we were talking about it later as augmented ALARP or something like that. And obviously it does both processes. And I think the point we make is that we would've said that's not particularly efficient. We would've said, you want to do what the WHS/OHS legislation asks first, and then if you want to do the second one, particularly if you're trying to work out what's prohibitively dangerous and whether or not, the way you put it, you can 'hop at any time'.

Gaye Francis (02:54):

I think it also, we talked about it before and it's that safety in design review and just putting in recognisable practice or standards that you're not looking for anything new or novel that you can do. And we've used, the one that we use for the dam break is that the current controls to make sure that the dam integrity stays intact and all of that sort of thing is to do regular inspections of the dam to make sure that there's been no movement that can be seen and things like that. And we're saying, well, maybe there's some technology out there that you could monitor the side of a dam and if there's any movement in it, then that could send alarms.

Richard Robinson (03:37):

That was that LIDAR based ground probe system.

Gaye Francis (03:39):

Correct.

Richard Robinson (03:41):

And obviously it'd only work for a hard face dam rather than with grass waving all over it. That wouldn't work. But that technology would work, and we've used it for railway cuttings, it would work really well.

Gaye Francis (03:51):

But that technology and solution doesn't exist in any of the guidelines or good practice that we know of to date.

Richard Robinson (03:58):

And I haven't had a dam person mention it to me. We've been doing it the other way around. Yeah, I would agree.

Gaye Francis (04:05):

So I think by following the Code of Practice and the ANCOLD guidelines, it's sort of doing "same old, same old" and not looking for that innovation.

Richard Robinson (04:16):

And the problem you've got is if you start with the target level of the risk approach and it turns out to be really low...

Gaye Francis (04:23):

What else are you going to do?

Richard Robinson (04:24):

It's hard to get yourself motivated looking for anything else that you could do. It sort of puts you in a culturally... you sort of don't want to do anything else because it doesn't seem much point.

Gaye Francis (04:35):

Well, you're almost in your comfort zone, aren't you?

Richard Robinson (04:38):

In effect. That's right. And you might remember in the presentation, I mean the Oroville Dam spillway break (in California), and I forget which the other dam was, but in each case, the American reviewer saying they were going to go and test what the design philosophy and cultural attitudes of the design team were when the dam was built. Because obviously, I mean we've been through this a number of times before, but in engineering term, the meaning's in the method. The design process will have certain consequences and if you've got a certain design process, you will get certain consequences. And if you look at this thing from different points of view, you do get different insight.

Gaye Francis (05:16):

And I mean, we've touched on this many, many times in our podcast that risk is multidimensional. And if you cut it different ways, if you look at it from a cultural viewpoint, you get a different insight into (as opposed to) if you look at it from a purely technical viewpoint. That dam that you were referring to was the Edenwille Dam (Michigan) break.

Richard Robinson (05:35):

Yeah, that's the other one.

(05:37):

Now, that was the other question which pops up a couple of times because in the safety case guideline, which was one of the reasons that the Dam Safety and Regulator in Queensland was attracted to us giving a presentation because he'd found that to be particularly helpful. But those cultural attitudes, the way you get ideas done. I mean, one of the observation we've had, it's not a bad idea to sort of get the community, who are at risk and brief them and get their feedback on what it all means.

(06:03):

Now, as you pointed out, that doesn't normally happen with dams. And you'd probably expect that it'd be the council who in one way represents the rate payers and residents downstream of a dam in a particular region who would probably have the greatest interest in this. Because there's nothing like having to explain as a dam owner or operator to a group of residents whom if the dam goes wrong, have a good chance of getting killed to actually have to explain what you're doing and why you're doing it. It does tighten up the argument, make it a lot more robust because the argument, the point went back, it's the principle of reciprocity. What you've really got to do is explain to them that as the dam owner an operator, if I was living downstream of the dam, this is what I have to ensure it would be reasonable. So it's that principle of reciprocity again.

Gaye Francis (06:53):

And it provides that transparency that people are looking for. And I think that's what appealed to the Dam Safety Regulator, that sometimes that safety case guideline could be used to establish some of those arguments in a transparent way that could be communicated to those stakeholders.

Richard Robinson (07:11):

Well, I think the thing that interests me the most is the last presenter was the General Counsel for one of the large water authorities in Queensland. And she just basically more or less went through the process the way R2A basically says to do it: Identify the issues, look at all the possible practical controls, determine in the circumstances which are reasonable and do that. Didn't have any problem following the ANCOLD guidelines as well, which was really from our point of view, a double up. And as we mentioned earlier, from the point of view of establishing whether something's prohibitively dangerous after you've put all your controls in place, it's probably not a bad thing to do anyway. So we're certainly not saying that the ANCOLD guidelines are massively in error or anything like that, but I think the difficulty we have is they're still doing it in the reverse order. But you can see from the way in which the legislation has been written and the code of practice has been written, why this confusion exists, it must exist at very high levels in just about every government agency.

Gaye Francis (08:04):

It's in a number of guidelines, isn't it that understanding of what they need to do. I think it's also creating a little bit of double-up work, and the process that it takes, and we've talked about this in a number of other podcasts, compliance with these guidelines and things like that where we are sort of saying, yeah, have a look at them and check them out. But following them as step-by-step guides usually doesn't meet the obligations of the legislation.

Richard Robinson (08:35):

And it certainly doesn't create innovation and create testing for other new ideas that could be potentially valuable. When you follow a standard, you just design to the standard. And that's that.

Gaye Francis (08:48):

And I think that's one of our topics for a podcast to follow. So I think unless you've got any closing comments, Richard, we might wrap this one up for today. So we hope you enjoyed that. It was an interesting presentation. We always enjoy giving these industry based presentations and that insight. So thanks for joining us today and hope you can join us next time.

Richard Robinson (09:10):

Thank you.

Safety Integrity Levels (SIL) Allocation and its implications under WHS Legislation

Risk! Engineers Talk Governance
Season 2, Episode 6

In this episode, Richard and Gaye discuss Safety Integrity Level (SIL) allocation and its implications under WHS legislation. 

They discuss their long history of working with IEC /AS 61508 and that their biggest caution is around Part 5 because it uses target levels of risk and safety as the basis for the SIL allocations. 

They share that they’ve seen SIL ratings work really well and, at other times, where there's been a misunderstanding of what SIL is. They explain the importance of getting the context right, put your hazard in, identify what your critical hazard is, and then look at all the controls that can be put in place. And often they're the civil design sort of things and mechanical designs before you even go to the electronic systems.

Read the full transcript below.

Episode transcript

Megan (Producer) (00:01):

Welcome to another episode of Risk! Engineers Talk Governance. In this episode, due diligence engineers Richard Robinson and Gaye Francis talk about Safety Integrity Levels (SIL) allocation. This was actually a suggestion from Ben on YouTube, so we thank him for the idea.

If you enjoy the episode, please give us a rating and help us spread the word and also subscribe on your favourite podcast platform. Enjoy and just like Ben, if you've got any feedback, please drop us a line.

Gaye Francis (00:37):

Hi Richard, welcome to another podcast session.

Richard Robinson (00:40):

Hello, pre-holiday Gaye. How are you?

Gaye Francis (00:41):

I know, I know. It's coming around fast.

Gaye Francis (00:45):

Today we're going to talk about, its actually a request for a podcast topic, which is very exciting. So we're going to talk about Safety Integrity Level Allocation, so SIL Allocation, and the implications of that, especially under the WHS legislation (OHS Act). So as always, Richard, hit us hard first and then I'll chip in as we go!

Richard Robinson (01:06):

Excellent Gaye!

Richard Robinson (01:08):

Well there's a whole chapter in our larger textbook (Engineering Due Diligence) about this because this is something that's been a frustration for us for a long time. I don't know if anyone's aware, but R2A was the functional safety assessor under IEC 61508 when it was a drafted in the late 1990s, I guess. And in fact, I think that was your first job (Gaye) when you signed up because we were literally doing the functional safety assessment for how two trains would get past each other on single line track in New South Wales. And that was your job; to test that their allocation and the way in which the watchdog, in particular, was going to work and would deal with every crossing, turnout and every other aspect of the system. So that started life as TOCS - -Train Order Control system -- and turned into TMACS -- Train Management and Control System. And I think our certification stopped about 2015.

Gaye Francis (02:03):

Yeah, it was about 15 years (ago). I think.

Richard Robinson (02:04):

It was only meant to be 10 years, as I recall. And they kept asking us to extend it. Obviously we were slightly anxious about this because if there ever had been a railway collision in that time, I doubt that we'd still be in business.

Gaye Francis (02:19):

Yes.

Richard Robinson (02:20):

Anyway, so at the time my signature was on the train control room at Orange, which I gather has now moved somewhere else, together with my then business partner, Kevin Anderson.

Richard Robinson (02:29):

Now this means we sort of spent a lot of time on this 61508 and it didn't become formalized I think until about 2001/2002, and they're now up to the second edition, which is 2010. Although because when Australia adopts it about a year later it turns into IEC 61508 or AS 61508 2011, which is incredibly frustrating.

Richard Robinson (02:52):

Anyway, I think it's, from memory in seven parts. Part 0 I think has been a more recent thing. The first four parts relate to a general functional safety assessment standard, which is used for the 61511. The functional safety assessment standard for control systems 62065, I think it is, for safety systems and I can't remember what the nuclear one is, but since that's going to be one of our next podcasts, you might recall that.

Gaye Francis (03:16):

I'll make a note.

Richard Robinson (03:18):

Excellent!

Richard Robinson (03:19):

Now the bit that's caused us the greatest grief in which the chapter is all about is basically the SIL Allocation because it uses target levels of risk and safety as the basis for the SIL allocations. So what it asks you to do, and this is in Part 5, what it asks you to do is a hazard risk analysis, work out what the current risk levels are. Then you have to work out what your tolerable or target risk levels are. Then you look at what the different control aspects are, like the existing external ??? think they call them, they change their name between the additions, which external risk reduction facility. And then whatever's left that becomes your SIL allocation. So if you need another two orders of magnitude risk reduction, well then arguably that would be a SIL 2 depending on whether it's continuous or low demand and all that sort of thing.

Richard Robinson (04:07):

Now so far as we're concerned, and that's where the crunch comes, using target levels of risk and safety, which was what the previous ALARP discussion was all about, is absolutely verboten under the provisions of the WHS legislation. And that's why we've always felt that 61508 was a particular problem.

Richard Robinson (04:27):

Now I think it's worth just commenting. I remember looking up the websites internationally a while back just confirming about 61508 and I remember reading a website, which I thought was particularly helpful, where it made the point that it's not a standard that's recognised good practice, it's the worthwhile ideas in the standard. So saying that the cell allocation is an error in 61508, which is one section of one part of seven parts, doesn't mean that the whole thing's futile or anything like that. I mean if you have to go through the process of actually realising the SIL level that you've actually selected, then so far as we know the standard works particularly well. But the problem is the initial SIL allocation, which as we've demonstrated in all the studies we've done, is usually where the greatest cost occurs in the sense that it commits you to a huge cost. I mean basically, as far as we're aware, going from SIL 1 to SIL 2 to SIL 3 to SIL 4, pretty much it means an order of magnitude increase for every SIL number that you go up by.

Gaye Francis (05:33):

In cost. That is.

Gaye Francis (05:36):

But we've also seen it being used in a number of other ways and I think this is where people get confused about it, isn't it? We've often seen it used to allocate a reliability target for a system and we've also seen it being used in isolation and allocating SIL levels to the electronic components without taking into account all of the other controls that are in the system to begin with. So they're often elevated SIL ratings than may necessarily be required.

Richard Robinson (06:07):

Well, the WHS legislation is particularly clear. You've got to eliminate if you can, and that's an absolute categorical imperative. And then if you can't eliminate, then you reduce. And it's weird because you find this remark and I sort of dug it out again, it's about halfway into the first part one and it says something to the effect that, well, no, not within the scope of this standard. It is a primary importance that the determined hazards of the equipment under control are eliminated at source, for example, by the application of inherent safety principles and the application of good engineering practice. But that's just a note like a footnote. It's not saying, you start with saying, can we eliminate this thing? And you might recall the Gateway bridge example in Queensland. We got called in to do a SIL study on an anemometer, an electronic variable message system for the top of the Gateway bridge, which is up in the air. So you can get high winds up there and high sighted vehicles, vans and so forth can get knocked around by wind at that elevation if you're not expecting it. And so they wanted to provide people with...

Gaye Francis (07:14):

Information of what the...

Richard Robinson (07:16):

About wind speeds. The problem was of course, if that information is an error, ie too high or too low or not there at all and people are relying on it, that could then cause...

Gaye Francis (07:24):

An incident or an accident. And they were wondering what SIL level that this needed to be.

Richard Robinson (07:30):

That's Right. And this is where the IT people sort of encouraged this process, as I recall.

Gaye Francis (07:33):

They do.

Richard Robinson (07:34):

Now this... Perhaps you should take over here.

Gaye Francis (07:38):

So we sort of spent the morning workshopping this and arguing for about a morning and then we didn't really come to any landing on it at lunchtime. And then somebody asked, well you've got the Westgate Bridge in Melbourne, what do you use in Melbourne? I said, there's flags on the top of it. So we don't have an electronic system saying what the wind speeds are in Melbourne, but you can tell by the direction of the flags which way the wind's going, whether it's a strong wind, whether it's not a strong wind -- a visual indication. So we came back after lunch and we sort of landed on the control of putting a wind sock on the Gateway bridge that if it was missing, it didn't give incorrect information. It couldn't give incorrect information. And if it was missing then the wrong information wasn't given to the drivers. So I think that's what they ended up landing on, wasn't it? And the electronic system was ditched altogether.

Richard Robinson (08:42):

Yeah, that's right. And so basically just put up a standard wind sock. You see it at an airfield with a light on it so you can see it at night and if it's obviously blowing in one direction and it's rock hard and sitting out to one side, it's blowing a gale in that direction. And that's what was done. And all the SIL status we've done with rare exception, we've downgraded the SIL rating by at least the order of magnitude very often by two.

Gaye Francis (09:07):

Yes. Or no SIL rating at all.

Richard Robinson (09:09):

Because it just didn't make sense. And the only way to do that, and particularly we do it within the context of the WHS legislation. Now you might remember that other study we did in Queensland where the tunnel, the jet fans, in order to sort of manage a fire in the tunnels and it had been given a SIL rating and the contractor, because it had to work for the OMCS and I can't remember what OMCS stands for, but it's an operating management system for the tunnel. The OMCS ran the ventilation system and the idea was, I think it was size that if you turn the jet fans on, you could actually manage a 50 megawatt fire from memory. Design was for a, I think was for a heavy commercial vehicle type fire.

Richard Robinson (09:56):

We turned up to do this review and it was kind of strange actually because first of all, they'd obviously called it up as a reliability standard as I recall, but they'd completely ignored the fire supression system which is an utterly independent system. And so when you looked at both these systems together combined, there was a SIL rating in effect on the fire system which could already be incorporated. And therefore from our point of view, the OMC system didn't actually need accelerating at all. But what was particularly entertaining, if we recall, this was just before the WHS Act commenced in Brisbane on the 1st of January, 2012. So we were working this in November/December, 2021.

Gaye Francis (10:37):

2011.

Richard Robinson (10:38):

2011, yeah, that's right. And I remember distinctly saying, guys, if we sign off under the old tolerable risk basis of things and we sign off, there's a clause in the legislation that says anything that's signed off beforehand doesn't have to be done under the new one as long as you've sort of got it underway. But if you fail to sign off it before Christmas this year and the legislation commences on the 1st of January, we'll all be back here again in the new year doing it again. And all the technical people laughed at us. Remember? <Yes.> They said, oh, you're kidding. And that was before the lawyer turned up and told them all to come back.

Gaye Francis (11:10):

Yes, we were back in the February of 2012, weren't we?

Richard Robinson (11:14):

Yeah we were.

Gaye Francis (11:15):

But again, because they hadn't sort of had the context right of the two systems operating independently, they had over allocated a SIL level to the OMCS as you said, but they didn't take into account the other system.

Richard Robinson (11:32):

Well, a fire system's normally a low demand system, that means it acts less than once per year and it normally has about a SIL 2 low demand rating. Now the ventilator system with regards to fire would have sort of the same frequency, low demand. And so if you add two systems together, you're sort of up to SIL 4, which obviously doesn't make any sense at all for something like that. So anyway, I can't actually recall what did we do there. I think we said it didn't need a SIL rating and I think we worked out, we actually did the numbers to work out what the reliability was and the reliability was considered so high. So whilst it wasn't formally SIL rated t was sort of seen to be adequately reliable as I recall.

Gaye Francis (12:13):

That's my recollection of it as well, that when we actually dug deeper into it, it was more a reliability target for operations rather than a SIL rating per se. Just before, I guess we move on from the SIL ratings. I know that you've said we really don't know how they got the numbers.

Richard Robinson (12:31):

No, what the 10 to the minus 1, 2, 3, 4 low demand then 5, 6, 7, 8 for high demand.

Gaye Francis (12:38):

They just seem to roll over from each other. So we've never been able to ascertain where those numbers were derived from or how they came about.

Richard Robinson (12:47):

No, I've asked at a number of conferences I've been to on SIL studies and things like that and given papers and I've always asked people and it's just one of those things. I mean I don't think we have a philosophical problem with orders of magnitude. I think we've always found it to be quite useful.

Gaye Francis (12:59):

Yes.

Richard Robinson (13:00):

But I've never seen any sort of scientific basis, as it were, for that understanding.

Gaye Francis (13:06):

Yes. Now we have seen SIL levels work well in other cases and we did do a bypass again in Queensland and it was a very narrow bypass that if a wider vehicle, wider truck was going along the bypass, it was one vehicle at a time, they needed traffic signals at either end to stop the traffic. And that was a blind spot. So they did end up SIL rating that, but it didn't have a super high SIL rating.

Richard Robinson (13:34):

That's correct.

Gaye Francis (13:35):

But it was a combination of safety integrity levels as well as a reliability target that these things worked when they were required. So we've seen SIL ratings work really well. We've seen other times where there's been a misunderstanding of what SIL is and they've been more aimed at reliability targets. So I guess with SIL it's one of those things that you have to have an understanding of what you're trying to achieve. Always look at it in the context of all the other controls that you've got in place when you're trying to solve the hazard that you're doing, not just looking at the electronic component of it.

Richard Robinson (14:11):

Well that was the other one, the tunnel under the freeway, remember under the airport

Gaye Francis (14:18):

The Tugan bypass at the Gold Coast airport.

Richard Robinson (14:21):

They wanted to accelerate the VMS system for that you might recall. And again, it was IT people working in isolation because they failed to reflect on the fact that these civil engineers had gone to a lot of trouble to design the tunnel, so as you came around the corner, you've got a clear view from one side of the tunnel to the other. And from a very practical viewpoint, if there's a fireball erupts in the tunnel, do you believe what you see through the windscreen or do you believe the variable message on the side of the road? And the answer is you look through the windscreen and respond to that. So if there's a fireball on the tunnel that you can see, don't go in the tunnel. You don't need a variable message sign to be a high reliability saying don't go there.

Gaye Francis (15:02):

And I think that's what it is. A lot of the time the SIL reviews have been done out of context.

Richard Robinson (15:07):

I think that's correct.

Gaye Francis (15:08):

So that would be probably our takeaway from this SIL podcast is make sure you've got the context right...

Richard Robinson (15:15):

Because that will normally reduce the SIL level and save you generally an order of magnitude of cost.

Gaye Francis (15:20):

Reduce the SIL level or eliminate the requirement for a SIL level sometimes, many times actually. So get the context right, put your hazard in, identify what your critical hazard is, and then look at all the controls that can be put in place. And often they're the civil design sort of things and mechanical designs before you even go to the electronic systems.

Richard Robinson (15:42):

And don't do the target level of risk approach described in 61508 Section 5 because so far as we know, you'll be setting yourself up for some kind of potential criminal charge under the WHS legislation, the way the world has currently gone.

Gaye Francis (15:58):

Alright. So I hope you found that interesting and as we said, again, if anyone's got any topics they'd like to shoot us, we're happy to talk about those as well. So thank you Richard.

Richard Robinson (16:07):

Pleasure Gaye.

Gaye Francis (16:10):

See you next time.

Richard Robinson (16:11):

Indeed.

What do you mean by the term Risk? The language of, and confusion around, Risk.

Risk! Engineers Talk Governance
Episode 6, Season 1

In this episode of Risk! Engineers Talk Governance, due diligence engineers Gaye Francis and Richard Robinson discuss the language of risk, why confusion reigns in organisations, and why they avoid using the term of risk altogether.

Transcript

Megan (Producer) (00:02):

In this episode of Risk! Engineers Talk Governance, due diligence engineers Richard Robinson and Gaye Francis talk about the language of risk and why it's so imperative for people within an organisation to be on the same page when using risk management terms. We hope you enjoy the episode. If you do, please subscribe on your favourite podcast platform and also check out the other episodes within this season of the podcast. Also, give us a rating and if you are after further information, all the details for Gaye and Richard are within the description. Enjoy the episode.

Gaye Francis (00:46):

Hi Richard, and welcome to another podcast session.

Richard Robinson (00:48):

Hello Gaye. Good to be here.

Gaye Francis (00:51):

So today we're gonna talk about the language of risk and some of the confusion that it has and some of the double meanings, I guess, and that you need to be careful when you are using (the word) within your organisation. 'cause it can have different meanings for different people.

Richard Robinson (01:06):

It's a little bit more than just double (meaning)!

Gaye Francis (01:09):

<laugh>. A few more meanings then.

Richard Robinson (01:12):

It depends who you're talking to.

Gaye Francis (01:13):

That's right. So we actually have a section in our book, in the Due Diligence Engineer Chapter 2 of our R2A text, and we're gonna go through that today and then go through what, what the different definitions are, how people use it, and then how we get around that confusion and the sort of language that we've tried to move to, especially in line with the WHS and Environmental legislation that now requires so far as reasonably practical.

Richard Robinson (01:42):

What do you mean: How do we get around it? What we basically do is avoid the term risk as far as possible.

Gaye Francis (01:47):

Well that was our conclusion. Yes. But <laugh>, we might work up to that.

Richard Robinson (01:53):

Well, first of all, I was just gonna go through the five meanings that we understand risk to have as a term. And then when you see it in the term risk management and you see the way different people use it and the different ideas that they have when they're using it, well you can see how these two things get so mixed up and scrambled.

(02:10):

Now the first one is, and this is the way sort of more or less historically as it happens, is risk as a noun. Now, a long, long time ago, I was trained as a highly protected risk engineer by Factory Mutual in the US and when they talk about highly protected risk, they talk about the site itself, the insured site, the risk site, that's a noun, right. They started that terminology in 1840 and so Zacharia Allen, I can take you through the history if you're particularly interested, but possibly not!

(02:38):

But the insurance world has always used risk as a noun because they're basically talking about the insured site. That's what they mean. What happened basically when risk management started and all the engineers turned up with sort of subsequent enthusiasm, was they started treating the word risk as an adjective to describe the risk associated with the hazard. So it's a property of the hazard rather than the thing in itself. And that's where you get that simultaneous appreciation of likelihood and consequence.

(03:07):

Then if you wind up in court, which is, and there's some examples in our book from a (New Zealand) court to that effect. See, once you wind up in court the fact is the thing has happened. So when the court uses the term risk after the event, they're talking about the likelihood of that particular outcome. So they're just using it as a likelihood after the event. But when the lawyers are writing before the event, as in the WHS legislation, they're talking about the risk, you know, the risk to health and safety. What actually are they talking about? Because they're not talking about the way in which lawyers talk about it after the event.

Gaye Francis (03:39):

No, they probably refer to it more as the consequence likelihood, a simultaneous appreciation of.

Richard Robinson (03:44):

Well, certainly when you read Chris Maxwell's review of the 2004 OHS Act, he seems to have that confusion even though he specifically wanted to put in the common law view, which is the hindsight driven view, which basically says that everybody's entitled to an equal level of precaution, which is actually derived from the likelihood side only for particular nasty big things that happen. So there's a bit of confusion there.

(04:10):

Then you get risk as a concept involving future uncertainty, which is just sort of part of the human condition. I mean, what's gonna happen next? I mean, you know, apparently we're not gonna have the Commonwealth Games in Melbourne anymore. We just recently discovered, well that's future uncertainty. And we sort of know a few people involved in that project. And one wonders how, well, we don't know what's gonna happen, do we!?

(04:31):

And then there's the last one, which is the finance people are using, which confuses people even more and which the risk management standard, despite their profession about... they talk about risk and reward, but then they talk about negative risk and positive risk, which is kind of more confusing 'cause the reward side is the positive risk and the negative side would be what we would normally have termed pure risk.

(04:53):

Now, it possibly gets even more muddly when you actually talk about the term risk management, which everybody uses with enthusiasm because it depends on who you're talking to as to what they mean by it. Now we're basically sort of rattling... this is from a fellow called Dr. Ron Bromley who is one of my old bosses from yonks ago, when I used to work for M and M Protection Consultants. M and M Protection Consultants was the lost control division of Marsh McLennan, as one of the Americans put it to us when he jumped off the plane from America and said to the assemble of Australians, two thirds of the world is covered by water, the other third is covered by Marsh McLennan. <laugh> That had about the same effect on you as it had on us! <laugh> But Americans are sometimes enthusiastic in this regard. Anyway, he basically just said, look, if you wanna know what somebody means by it, just look at who they're and what they do with it.

(05:44):

So a safety manager, and that's sort of the person who sort of started to talk about risk management in the first instance, they were talking about maximising safety budgets, getting the greatest resources to the best works they can to minimise loss. That's what they in mind.

(05:58):

When you're talking about a risk manager, which was the next term that sort of popped up from the safety manager, well, they're out to maximise corporate profits.

Gaye Francis (06:07):

Yeah, there was more a corporate organisational approach.

Richard Robinson (06:12):

The problem is they probably didn't really understand the contribution of the sort of the physical management of risk to results in the way that the safety manager did because they were always fretting out what could go wrong.

(06:23):

Then you had the line manager who started using the term risk management and they wanted to maximise production objectives and maximize profits.

(06:30):

Then the legal advisor and lawyers, they sort of hopped in and started using the term risk management. What they meant by that they're out to manage potential conflicts and win court cases.

Gaye Francis (06:39):

So it became almost a liability management tool, didn't it?

Richard Robinson (06:42):

Correct. Disputes equals prosperity too. And sign off is difficult.

Gaye Francis (06:47):

For the law profession. Yes. <laugh>

Richard Robinson (06:48):

For the legal lawyers. That's right. But then the asset managers got a hold of the idea. That's one of the reasons why the risk management standard mutated from being strictly a downside risk asset management process and went upside downside. Well, they wanted to maximise investment returns and minimise downside risks. They wanted to maximize upside, minimize downside. Which gives rise to your frustration....

Gaye Francis (07:12):

The chance between zero harm and risk appetite. Because no one has an appetite for safety. Downside safety outcomes.

Richard Robinson (07:21):

Killing and maiming. Nobody's got an appetite for that. But if you're talking about upside downside, yes, you need a risk appetite statement.

(07:29):

Then you've got the underwriters, well they want to maximise underwriting profits, but that means they have a narrow approach. And I think what's happened is their approach was so narrow, basically they're being ignored now. I think they actually sort of dipped outta that one.

(07:39):

Then you've got the insurance brokers, well, they're out to get more clients and maximize profits, but affordable services only. I remember one broker telling me something along the lines, now look Richard, in order to get the business, we promised the earth and having got the business we conduct "a realistic reassessment of the insured's needs". <laugh>

Gaye Francis (08:00):

Not quite the way to do business. Or get the best... well gets them the best results!

Richard Robinson (08:04):

Gets the best result for them.

(08:06):

Then you've got board members, well, they're out to maximise profits, but they're also out to minimise personal liability. And when you look at the WHS legislation, well the big guys are still as we still seem to have the corporate veil working for them, but the small guys don't, from what we've seen.

(08:22):

And then you've got auditors. Well, their job's to confirm that reality matches history - the two things, history and reality align or what people are saying is what's actually occured are actually aligning. But this is a historical analysis. The past doesn't reflect the future. So if they're saying something about what happened the last five years, who's gonna say what happened in the last five years is gonna be reflective of the next five years. It just doesn't happen.

Gaye Francis (08:45):

No. So with all of those different meanings (of risk) to start with, and then the way that different people use it and organisations use it, then there is a huge confusion out there. So, you know, we often get the requests: Can you come and do some risk management for us or a risk assessment for us? And it's sort of like: Okay, what are you trying to achieve with this? And until you actually sit down and look through what they're trying to achieve and who's asking the question, it depends on sort of the process that we use.

Richard Robinson (09:14):

The call we got this morning about resilience. So people are using resilience both as a pre-emptive and a post-emptive strike, aren't they? They haven't quite decided, have they?

Gaye Francis (09:23):

No. But it all goes towards their risk management.

Richard Robinson (09:27):

The management of risk.

Gaye Francis (09:28):

Yes, of future uncertainty. So, like we were talking before, Richard and I try not to use the term risk and and risk management. So we often do issues workshops. And because the legislation, especially in safety terms, ask for all reasonable practical precautions so far as is reasonable practical, we often call them SFAIRP reviews.

Richard Robinson (09:51):

Correct. Well, that's the only way to do it. Because that is your legal duty.

Gaye Francis (09:54):

And it cuts through all of the knots associated with risk and people's preconcep... Can you help me out with the word? <laugh>

Richard Robinson (10:04):

Preconceptions.

Gaye Francis (10:05):

Thank you. Tongue twisted today!

(10:07):

...on what risk is. Because often they come with that and if they go to a workshop they're expecting for, typically in engineering cases, the consequence and the likelihood to be characterised.

Richard Robinson (10:21):

I'll have to try some more words on you. <laugh>. Transmogrification. How do you feel about that? <laugh>

Gaye Francis (10:26):

That's a very impressive word!

Richard Robinson (10:28):

<laugh>. Well, as you can see, our view about all this is that when you sort of have somebody who starts talking risk management, you've really gotta have a look at how they use the term if you really wanna understand what they're about. And our general experience is if you're sitting around the board meeting and somebody starts using the word risk management and they've all come from different career paths to get there, you basically have instant confusion unless somebody actually gets up and sorts it out.

Gaye Francis (10:54):

So I think for us, absolutely look at at risk as future uncertainty, but it really focus on the controls that you need to put in place to manage it. And then it really doesn't matter from which aspect you come for it, from what position you have or, you know, take you have on it, if you're focusing on what the controls are going forward, it should manage all of those things. It should be a liability management tool. It should improve safety. It should be able to give you good returns on investment. If you do all of that, if you're focusing on the precaution based approach.

Richard Robinson (11:31):

Well, it's a little bit more than that. It's actually, you know, 2000 years of western philosophy. But for some reason we keep forgetting the whole point is your fate isn't fixed. You can change it if you want to.

Gaye Francis (11:42):

That's true. <laugh> That was very deep on a podcast.

(11:48):

So what we're saying is just be careful with the language of risk. Understand who you're talking to. And some of these buzzwords are being used, as Richard said, resilience seems to be the new one, but it is a form of risk management, you're just trying to get the best out of your assets, and it's being required to deliver it. So just be careful around buzzwords and what you actually mean and dig deep enough to get that understanding.

(12:17):

So thank you for joining us again. We hope you found it interesting. We look forward to presenting another podcast in the near future.