HOW TO MEASURE AND

EVALUATE RISK
Strictly speaking, one does not accept risks. One accepts options that entail some level
of risk among their consequences. (Fischhoff et al. , 1981)

Risk assessments are usually performed to provide input to a decision. The decision
may, for example, concern modification of equipment, allocation of risk
reduction expenditures, or siting of a hazardous plant.

Common to all is the need to specify what to measure and how to evaluate what
has been measured. How we measure risk will ultimately determine what
information we can get from a risk analysis and the validity of our conclusions.
RISK INDICATORS
A quantitative assessment of the risk related to a system or activity has to be
based on one or more indicators. There are two main types of indicators: one,
called a risk indicator, that is used to predict what will happen in the future, the
other, to address what has happened in the past.

Risk indicator: A parameter that is estimated based on risk analysis models and by using
generic and other available data. A risk indicator presents our knowledge and belief about a
specific aspect of the risk of a future activity or a future system operation.
The "risk level" in the past, was called safety performance and an indicator of this
performance is therefore called a safety performance indicator.

Safety performance indicator: A parameter that is estimated based on experience

data from a specific installation or an activity. A risk performance indicator therefore
tells us what has happened.

Risk indicators are used to assess (prospective) risk, whereas safety performance indicators
are used mainly for monitoring purposes, that is, to check whether the safety performance
has been constant, increasing, or decreasing, and to compare the safety performance of
one activity with that of other activities.
Risk indicators are used to assess (prospective) risk, whereas safety performance indicators
are used mainly for monitoring purposes, that is, to check whether the safety performance
has been constant, increasing, or decreasing, and to compare the safety performance of
one activity with that of other activities.
Risk indicator for deep-diving operations

A company is about to launch a new type of equipment for deep-diving operations. Let Θ denote the
probability that the diver will be killed during a specific diving operation when using the new equipment. The
probability Θ may be considered as a parameter that can be estimated based on risk analysis of the new
equipment and the diving operation, combined with generic data from similar equipment and similar diving
operations. The estimate is based on available knowledge and data, and gives an indication of what risk the
diver will face by using the new equipment. The value of Θ is therefore a risk indicator. Note that Θ only
provides partial information about the risk the diver is facing, since it is concerned only with the fatality risk,
not with the probability of being injured.

When the new equipment has been used for some time, we may estimate the parameter Θ from the
recorded data by standard statistical techniques. We denote this estimate by Θ* to distinguish it from the
(prospective) risk indicator. The estimate Θ* is a safety performance indicator that tells us what has been
experienced.

Let Θ be a parameter that provides information about the risk of a system or an activity. In the following, we
use the same symbol, Θ, to denote the risk indicator, that is, the prospective estimate that is deduced from
risk models and generic data. We use Θ* to denote the safety performance indicator that is estimated
based on experience data. It is important to note that a single risk indicator does not give a complete
picture of the risk but, rather, is an indication of one dimension of the risk (e.g., personnel risk).
RISK TO PEOPLE

A single death is a tragedy, a million deaths is a statistic.

-Josef Stalin

Risk to humans can be classified into two distinct groups:

(a) Individual risk is the risk that an individual person is exposed to during a specific time
period (usually, one year). Individual risk is usually addressed in terms of a hypothetical or
statistical person, who is an individual with some defined, fixed relationship to the hazard.
This may be the most exposed person, for example a train driver, or a person with some
assumed pattern of life. The analyst has to define a number of hypothetical persons to
ensure that the entire exposed population is addressed. Individual risk does not depend on
the number of people who are exposed to the hazard.
(b) Group risk is the risk experienced by a group of people. When common citizens are
exposed, the group risk is often called societal risk. In this book we prefer the term
group risk both when the group members are employees in a specific company and
when they are common citizens. The group risk is a combination of individual risk levels
and the number of people at risk, that is, the population being exposed.
The following definition by the UK Institution of
Chemical Engineers is often cited:

Societal risk: The relationship between frequency and the number of people
suffering from a specified level of harm in a given population from the realization
of specific hazards (IChemE, 1992).

An example of group (or societal) risk is air travel. Major airplane disasters cause
grief and shock throughout a country, followed by detailed inquiries into their
causes and demands of general action to reduce this sort of risk. It is such
reactions that distinguish group risks from the more mundane risks that do not
have disaster potentials, such as motoring, even though the latter may result in
many more fatalities per year.
 Individual Risk per Annum

Consider an individual who is exposed to a specified set of hazards, “a”. The hazards may
be due to a special activity or a special situation: for example, driving a motorcycle or living
near a hazardous plant. A relevant risk indicator may be the probability that the individual
will be killed due to the specified hazards, “a” during a period of one year. The resulting risk
indicator is called the individual risk per annum (IRPAa ), with respect to the hazards “a”,
and is defined as

IRPAa = Pr(individual is killed due to hazards “a” during one year's exposure)
 IRPAa may be estimated based on the number of fatalities observed in a specified time
period for a specific group of individuals who have been exposed to the same hazards a,
by

observed no. of fatalities due to hazards a

IRPAa * =
total no. of person-years exposed

The IRPAa* is now a safety performance indicator that gives us an indication of the individual risk
in the specific group of individuals in the specified (earlier) time period.
EXAMPLE Individual accident risk in Norway

In 2009, I 989 persons were killed in accidents in Norway out of a total population of
about 4 900 000 people. For a person chosen at random from this population, the
probability of being killed in 2009 was

I, 989
IRPA * = ~ 4 x I0^-4
4,900,000

This means that in a group of I 0 000 persons chosen at random, on the average four
got killed in an accident in 2009.
The expression is an estimate of the total individual risk per annum (IRPA) of a person chosen at
random among all inhabitants in Norway.
A detailed analysis of the mortality data shows that the total IRPA * is
strongly dependent on age and gender. A high percentage of the fatalities
are elderly people who fall in their homes. The lowest total IRPA * is
observed for children in the age range from 5 to 15 years. In this age range,
the total IRPA * is about 2 · 10^-5. This means that in a randomly chosen
group of I 00 000 children between 5 and 15 years old, approximately two
children die per year. The average IRPA * for this group of children has been
rather stable over many years in Norway, and approximately the same
value is also found in most countries in Western Europe.
Consider the individual risk for crew members on cargo ships. Some hazards are
relevant only during ordinary working hours, whereas other hazards are relevant 24
hours a day. The type of accident under consideration will therefore determine
whether the exposure time should be measured as working hours or as total time spent
onboard. Assume that we have data from an accumulated number of Τs = 29 500
cargo ship-years (one ship-year is of one ship during one year). Each ship has an
average number of crew members (persons on board, POB) = 25, and each crew
member spends on average a = 50% of the year onboard. Further assume that n = 490
crew members have been killed during this exposure time. The safety performance
during this period is hence
n 480
IRPA* = · a= · 0.5 ~ 3.3 ·10^-4
Τs· POB 29 500 · 25
Potential Equivalent Fatality

In many cases the risk to people is not adequately described by the fatality risk,
and injuries should also be taken into account. This is sometimes done by
comparing injuries and disabilities with fatalities and trying to calculate a potential
equivalent fatality.

Potential equivalent fatality (PEF): A convention for aggregating harm to people by

regarding major and minor injuries as being equivalent to a certain fraction of a
fatality (RSSB, 2007) .
EXAMPLE London Underground QRA

In a QRA of London Underground Limited potential injuries were classified into

minor and major injuries. Major injuries were given the weight 0.1, such that ten
major injuries were considered to be "equivalent" to one fatality (i.e., 10 x 0.1 = 1 ).
Minor injuries were given the weight 0.01, such that a hundred minor injuries were
considered "equivalent" to one fatality.
 LIRA see p.82
Approaches to Risk Acceptance

A numberof different approaches have been developed for determining whether or not the
risk related to a system or an activity is acceptable.

The ALARP Principle. ALARP is an acronym for "as low as reasonably practicable" and is the
UK principle for risk acceptability. ALARP has two main components:

(a) It provides a framework for analyzing risk (i.e., identifying risks and risk reducing
measures). This requires explicit description and analysis of risk tolerability.

(b) It involves a method of determining if the cost of a risk-reducing measure is

disproportionate to the benefits it will provide, and hence if the measure should be
implemented.
 When using the ALARP principle, the risk is divided into three levels, as illustrated

I. An unacceptable region, where risks

are intolerable except in extraordinary
circumstances, and risk reduction
measures are mandatory.

2. A middle band, or ALARP region,

where risk reduction measures are
desirable but may not be
implemented if their cost is grossly
disproportionate to the benefit
gained.

3. A broadly acceptable region,

where no further risk reduction
measures are needed. In this region,
further risk reduction is
uneconomical and resources could
be spent better elsewhere to reduce
the total risk.
We thus have to state two risk limits:
an upper limit (i.e., between the
unacceptable region and the
ALARP region) over which the risk
cannot be justified on any grounds,
and a lower limit (i.e., between the
ALARP region and the broadly
acceptable region) under which
the risk is considered generally
acceptable.

The ALARP principle is relevant

primarily for risk to humans. The
vertical axis in the figure (not shown)
is thus a measure of individual risk, for
example IRPA.
UK has defined the upper and lower limits for IRPA in the table shown
The risk is usually in the ALARP region, which is the region where the risk must be reduced to
an ALARP level. In determining what is "reasonably practicable," the following five items
must be considered:

I. The severity of the hazardous event in question.

2. The state of knowledge about the hazardous event, and the ways of preventing or
mitigating its effects.

3. The availability and suitability of ways to prevent the hazardous event or to mitigate its effects.

4. The cost of preventing the hazardous events or mitigating its effects.

Cost-Benefit Assessment. ALARP implies that a cost-benefit approach must be adopted to
decide what constitutes a "reasonable" level. In the ALARP region, the notion "grossly
disproportionate" is central. It requires that a risk-reducing measure be implemented if the cost
of the measure is not grossly disproportionate to the benefit gained.

A disproportion factor d may be calculated as

cost of the risk-reducing measure

d =
benefit of the risk reduction
The benefit of implementing a risk-
The cost of the risk-reducing measure is an estimate reducing measure is an estimate of
of the total cost, which covers purchase, installation, the "cost" reduction implied by
and training, but also cost implications related to the fewer injuries and fatalities, and
operation of the system, for example: reduced also of possibly reduced input
productivity. resources and/or improved system
productivity.
The evaluation of disproportionality is carried out by first defining a disproportionality limit
do.

If the actual factor d as calculated is less than do, the risk-reducing measure should be
implemented,

and if d > do, it should not be implemented.

A disproportionality limit of, for example, do = 3 means that for a measure to be rejected,
the costs should be more than three times larger than the benefits.

There are no strict authoritative requirements on what limit to employ, but it may seem
reasonable to use a higher value of do for high risks (i.e., close to the upper limit) than to
lower risks.
A challenge with the cost-benefit approach is that it raises the problem of expressing not
only the costs, but also the risk-reducing benefits in monetary terms. This is a particularly
sensitive issue when it comes to putting a value on human life. To guide decision-making,
some companies use internal criteria for the value of human life.

An alternative to such explicit valuation of human life is simply to calculate the cost-benefit
ratio for any risk-reducing measure, and to look out for any clearly unreasonable situations.

In essence, the ALARP principle states that money must be spent to reduce risks until they are
reasonably low, and must continue to be spent for as long as it is costeffective to do so and the
risk is not negligible. If a "tolerable" level of risk can be reduced further at a reasonable cost
and with little effort, it should be. At the same time, the ALARP principle recognizes that not all
risk can be eliminated. Since it may not be practicable to take further action to reduce the risk
or to identify the accidents that pose the risk, there will always be some residual risk of
accidents.