Many organizations partially address this requirement by establishing an ergonomics program in order to address physical human factors.  Only a few organizations explicitly address mental human factors as a part of their hazard identification and risk assessment. 

Yet, mental human factors are very real and can be just as important as physical human factors.  In some cases, they are even more important.  For example, when one is driving a car, factors that reduce mental acuity – such as talking on a cell phone – are typically much more significant than physical capabilities.  The dangers of being distracted while driving is important enough that the first Distracted Driving Summit was held last fall and the U.S. Department of Transportation has set up a Distracted Driving website. 

The human brain has been described as having “a very large hard drive but limited random access memory (RAM).”  As demonstrated by our proficiency at trivia games and success in answering questions on quiz shows like Jeopardy, the human brain is capable of storing a great deal of information.  On the other hand, studies show that most people have difficulty remembering more than 7±2 items at a time in short term memory.  Our mental processes were developed for a very different environment than we find ourselves in today.  In the past, our modes of information delivery moved much, much slower with significantly fewer “inputs per minute.”  

Yet we design work environments as if this mental limitation does not exist. 

We expect individuals to work at full capacity in environments with multiple stimuli.  We set up equipment lines so they are efficient for the machines but terrible environments for the people who have to work there.  We design work processes and work shifts as if mental limitations do not exist.

Unfortunately, when accidents do occur – which they inevitably will – we blame the individuals involved and tell them how “bad” they are. 

I’m not sure if this is silly, sad or tragic but it sure is NOT a sound management system approach.

© ENLAR® Compliance Services, Inc. (2010)

The need for considering “the human element” was brought home to me by the recent flurry of articles and news reports covering the hazards associated with using cell phones when driving.  According to these reports, a study conducted by the National Highway Traffic Safety Administration found that talking on a cell phone while driving is as dangerous as drinking alcohol and driving.

These news reports, and similar ones on the use of tanning beds by teenagers and the lack of hand hygiene in health care, lead me to wonder:

• Why do people use cell phones while they are driving?
• Why do teenagers pay to use tanning beds?
• Why do doctors treat patients without washing their hands?

Why do individuals make such seemingly “irrational” decisions?

I’m not sure I have a satisfactory answer to this question; however, asking this question is an important part of your OH&S management system.

OH&S hazards are not limited to faulty equipment and hazardous materials, they also involve the human element – how people behave and WHY they behave as they do.

OHSAS 18002 suggests that when conducting your hazard identification, you should consider –

• The nature of the job (workplace layout, operator information, work load, physical work, work patterns)
• The environment (heat, lighting, noise, air quality)
• Human behavior (temperament, habits, attitudes)
• Psychological capabilities (cognition, attention)
• Physiological capabilities (biomechanical, anthropometrics/physical variation of people)

Considering these factors – and their interactions – can help you determine why individuals are behaving as they are and what OH&S hazards are being created as a result.  Only if you understand “the human element” will you have the information you need for determining the appropriate OH&S controls to put in place.

© ENLAR^® Compliance Services, Inc. (2009)

Disney Fireworks

Unfortunately, early Sunday morning tragedy struck Disney’s transit system when two monorail trains collided – killing one of the train operators.  According to news reports, the Occupational Safety and Health Administration (OSHA) is currently conducting an investigation into this accident. 

I was contemplating this accident – and the resulting negative publicity for Disney – as I reviewed the latest draft of ISO 31000 – ISO’s newly developed Risk Management standard.

One of the weaknesses of many risk management programs is failing to fully evaluate the risks associated with events that are rare (low likelihood) but with the potential for severe (highly negative) consequences.  In Section 5.5.2, ISO 31000 suggests that such events may warrant risk treatment even when it appears that action may not be justifiable on strictly economic grounds.  The typical assumption being that the event will never happen; therefore, the time and money expended to evaluate and address the risk will be wasted.

This monorail accident appears to be this type of an event. 

It was clearly rare.  According to Disney, this is the first fatal crash in the 38-year history of the monorail’s operation.   

Yet, the consequences of this accident are likely to be severe –

• death of an employee
• reduced confidence in – and utilization of – the transit system by guests
• the costs incurred associated with an OSHA fatality investigation – even if no fines are imposed
• negative publicity for a company that is very concerned about maintaining a positive public image

Take ISO 31000’s advice to heart in your own risk management programs – including the risk assessments conducted to meet the requirements of OHSAS 18001.  Be sure that your low likelihood risks are evaluated - including those associated with abnormal or unusual activities.  As the accident at Disney proved, just because an event hasn’t happened yet, that doesn’t mean it may not happen tomorrow.

© ENLAR^® Compliance Services, Inc. (2009)

Elimination is considered the most relable control measure because, if a hazard is eliminated, it no longer poses a risk.  On the other hand, control measures that rely on individuals behaving in a certain way are considered less reliable. The wearing of personal protective equipment (PPE) is considered a less reliable control because it is dependent on individuals using the right PPE and wearing it correctly.

For example, lets say the “hazard” one wants to control is exposure to a chemical used in cleaning a manufacturing area that is likely to cause ill health at a certain level of exposure. 

To use the “hierarchy of controls” protocol – you would take the following steps –

1. Explore whether the use of the chemical can be eliminated
2. If the use of the chemical cannot be eliminated – then you would explore whether there is a substitute chemical that can be used that does not have the same potential to cause ill health
3. If the use of the chemical cannot be eliminated and there is no suitable less toxic substitute – then one explores whether there is an appropriate engineering control  – such installation of a ventilation system that reduces the exposure
4. If an engineering control cannot be used (or until it can be installed), then other “adiminstrative controls” such as warning signs, PPE, etc. would  need to be put in place to reduce the hazard

The use of hierarchy of controls is a reiterative process – as individual control measures are put in place, you need to go back and re-evaluate the risk to see if it has reached an acceptable level or if additional controls are still needed.

For any particular hazard, more than one control measure may be needed to address the risk.  For example, controlling the risk of exposure to a toxic chemical may require the installation of a ventilation system AND establishing a preventive maintenance program for the ventilation system AND the use of warning signs AND the use of PPE. 

© ENLAR^® Compliance Services, Inc. (2009)

ABC News reported on just such a situation last night.  It included a segment on the health implications of driving a school bus and the steps Broward County, Florida has taken to address them.

What did the Broward County School Board do?

They initiated an employee wellness program focused on improving the overall health of their bus drivers.  This included offering incentives for drivers to participate in a regular exercise program.   

Why does driving a bus pose a health hazard?  

Driving a bus is a sedentary activity.  Bus drivers, like other drivers of commercial vehicles, may spend hours sitting in one spot – even if that “spot” happens to be moving.  As a result, drivers often gain weight and develop other health conditions such as high blood pressure and/or diabetes.  This is on top of other hazards, such the risk of injury due to accidents and exposure to diesel fumes.

Why did the school board act?

In addition to the desire for healthy drivers, the school district was concerned about cost.  According to the school board wellness coordinator – “Those types of health conditions (high blood pressure and high cholesterol) translate into high claims.  The school board wants to save lives and reduce claims.”

So when you are doing your hazard identification – be sure to ”think outside the box.”  Don’t limit your investigation to only the inside of your facility.  Make sure you look outside as well.  Include workers such as bus drivers, outside sales staff, repair technicians, and mobile workers – their health is important as well.

© ENLAR^® Compliance Services, Inc. (2009)

It is equivalent to assembling a meal from an a la carte menu.

So what are your a la carte choices?

They are numerous and varied and include –

• Checklists and questionnaires
• Consequence / likelihood matrices
• Failure modes and effects analysis (FMEA)
• Hazard and operability studies (HAZOP)
• Exposure assessment strategies
• Bayesian analysis
• Ergonomic evaluations
• Computer modeling programs

Just as the key to healthy eating is making wise menu choices, the key to a sound OH&S risk management strategy is choosing the hazard identification and risk assessment tools that are appropriate for your organization.

© ENLAR^® Compliance Services, Inc. (2008)

“Can you provide a generic risk assessment process I can just plug into my aspect/impact procedure?”

The short answer to this request is “No.”

This is the fundamental difference between the OHSAS 18001 and the ISO 14001 standards.  To conform to ISO 14001, many organizations have a single aspect/impact evaluation process.  It may be complex and involve several factors and complicated calculations but it is typically one process.  This is not the case for OHSAS 18001 hazard identification and risk assessment.

To quote from the OHSAS 18002 guidance –

Hazard identification and risk assessment methodologies vary greatly across industries, ranging from simple assessment to complex quantitative analyses with extensive documentation.  Individual hazards may require that different methods be used, e.g. an assessment of long term exposure to chemicals may need a different method than that taken for equipment safety or for assessing an office workstation.  Each organization should choose approaches that are appropriate to its scope, nature and size, and which meet its needs in terms of detail, complexity, time, cost and availability of reliable data.  Taken together, the chosen approaches should result in a comprehensive methodology for the ongoing evaluation of the organization’s risk.

In other words – there is no simplistic answer or cookie-cutter methodology.  It is not one process but several that, when taken together, make up a comprehensive risk management strategy.

© ENLAR^® Compliance Services, Inc. (2008)

To meet the OHSAS 18001 requirements, an organization must:

• Identify its OH&S hazards
• Assess the risks associated with the OH&S hazards that are identified
• Determine the controls that are necessary to reduce OH&S risks to an acceptable level

Identification of OH&S hazards and assessment of the associated risks is one of the primary inputs for setting objectives for continual improvement, identifying training needs and establishing operational controls.

The risk management foundation of OHSAS 18001 is not explicitly found in either ISO 9001 or ISO 14001.   ISO 9001 focuses on identifying customer requirements and achieving customer satisfaction; ISO 14001 focuses on identifying environmental aspects and prevention of pollution.  Although risk management is important to quality and environmental management, neither ISO management system standard explicitly addresses this.

Interestingly, ISO is currently in the process of developing several risk management standards.  According to ISO, these standards are intended to provide guidance to assist organizations in managing risk – including safety and environmental risk.  In addition, according to its Scope statement, ISO 31000 is intended to “harmonize risk management processes and definitions in existing and future standards.”

The ISO risk management standards currently under development include the following:

• Substantial changes to the definition of risk in Guide 73 – Risk management – Vocabulary - Guidelines for use in standards
• Drafting of a new “strategic-level” risk management standard – ISO 31000 – Risk management – Principles and guidelines on implementation
• Adoption of an IEC standard outlining risk assessment methods as an ISO standard – ISO 31010 – Risk Management - Risk Assessment Techniques
• Drafting of a new standard on risk assessment of structures - ISO 13824 - General principles on risk assessment of systems involving structures

This ISO standard-setting activity raises a couple of interesting questions –

1. Will future revisions of ISO 9001 and ISO 14001 include a risk management focus as well?
2. Might risk management become the unifying foundation for an integrated management system standard?

© ENLAR^® Compliance Services, Inc. (2008)

There were many excellent sessions covering a wide range of topics important to the practice of industrial hygiene.  In particular, the Tuesday morning general session focused on demonstrating the value of the industrial hygiene profession and included a presentation by Jeffrey P. Pino, President of Sikorsky Aircraft Corporation.

In his presentation, Mr. Pino stated that there are three strategies important to a successful HSE (health, safety and environmental) program:

• Leadership Commitment
• Employee Engagement
• Risk Management

These three strategies are also critical to the implementation of an occupational safety and health management system based on OHSAS 18001:2007.

Demonstrating Leadership Commitment

To demonstrate conformance to OHSAS 18001, top management must be directly involved in the OH&S management system.  The involvement of top management is explicitly required in section 4.2 (OH&S Policy), 4.4.1 (Resources, roles, responsibility, accountability and authority) and 4.6 (Management Review).

In particular, top management must:

• Define and authorize the organization’s OH&S policy
• Ensure the availability of the resources needed for the OH&S management system
• Define roles, allocate responsibilities and accountabilities and delegate authorities to facilitate effective OH&S management
• Ensure the OH&S management system is implemented
• Periodically review the continuing suitability, adequacy and effectiveness of the OH&S management system

Promoting Employee Engagement

One of the major changes in the 2007 revision of OHSAS 18001 is an increased focus on worker participation and consultation with other interested parties.

Section 4.4.3.2 of OHSAS 18001 requires that the organization establish, implement and maintain procedures for worker participation in the OH&S management system, as well as consultation with contractors and other relevant external interested parties, such as regulatory agencies.

It should be noted that, in OHSAS 18001, “engagement” is not limited to just employees – it requires the inclusion of others whose safety and health may be impacted by the activities of the organization.  This expansion beyond just employees is an explicit recognition of the significant change in the relationships in today’s workplaces.  A significant amount of work – particularly dangerous work – is outsourced to contractors.  Many workers are brought in as temporary workers, not employees, and kept on as such for months or even years at a time.

Implementing Risk Management

With an increased focus on effective corporate governance has come an increased interest in corporate risk management.

Unlike ISO 14001:2004 or ISO 9001:2000, OHSAS 18001:2007 is explicitly based on risk management principles.

Risk is a defined term in OHSAS 18001.  It is defined as the “combination of the likelihood of an occurrence of a hazardous event or exposure(s) and the severity of injury or ill health that can be caused by the event or exposure(s).”

The standard also has definitions for risk assessment (the process of evaluating the risk or risks arising from a hazard, taking into account the adequacy of any existing controls, and deciding whether or not the risk is acceptable) and acceptable risk (risk that has been reduced to a level that can be tolerated by the organization having regard to its legal obligations and its own OH&S policy).

Hazard identification, risk assessment and the determination of appropriate controls, as set out in section 4.3.1 of the standard, are the foundation of an OHSAS 18001 management system.  The identification of OH&S hazards and assessment of the associated risks is the primary input for setting objectives, identifying training needs and implementing operational controls.

© ENLAR^® Compliance Services, Inc. (2008)

Explicit requirements for management of change were added into section 4.3.1 of OHSAS 18001 in the 2007 revision of the standard.  This addition was an explicit request of the American Industrial Hygiene Association for purposes of aligning OHSAS 18001 with the U.S. Occupational Health and Safety Management System standard – ANSI/AIHA Z10-2005.  In addition, management of change is also an explicit requirement for safety management systems implemented to comply with the Seveso II Directive (see Annex III of EU Council Directive 96/82/EC).

 The following requirements related to management of change were added in section 4.3.1:

 The procedures for hazard identification and risk assessment shall take into account:

g) changes or proposed changes in the organization, its activities or materials; h) modifications to the OH&S management system, including temporary changes, and their impacts on operations, processes and activities;…. For the management of change, the organization shall identify the OH&S hazards and risks associated with changes in the organization, the OH&S management system or its activities, prior to the introduction of such changes. 

These new requirements cover four important concepts:

• Identification of the hazards associated with “change”
• Assessment of the risks associated with “change”
• Consideration of OH&S hazards and risks prior to the introduction of the “change”
• Implementation of the controls needed to address the hazards and risks associated with the “change”

For purposes of management of change within an OH&S management system, the changes that need to be addressed include:

• Organizational changes (e.g. personnel or staffing changes)
• Activity changes (e.g. changes to processes, equipment, infrastructure, software)
• Material changes (e.g. new chemicals, packaging)
• Changes to the OH&S management system (e.g. procedures)

Why is management of change so important?

Ineffective management of change is one of the leading causes of serious incidents.  To quote the U.S. Chemical Safety and Hazard Investigation Board (CSB), “In industry, as elsewhere, change often brings progress.  But it can also increase risks that, if not properly managed, create conditions that may lead to injuries, property damage or even death.” (from CSB press release announcing its 8/28/2001 Safety Bulletin concerning “Management of Change”)  Ineffective management of change is one of the major contributing factors in many of the incident investigations conducted by the CSB.  To check it out, go to the CSB web site at http://www.csb.gov  and enter “management of change” as your search term at the link “Search this Site.”

© ENLAR® Compliance Services, Inc. (2007)