Abstract
ALARP (As Low as Reasonably Practicable Risk) is a term used by some companies and regulators to provide a framework for deciding on the level of investment needed for safety programs.
Acceptable Risk
Given that risk is basically subjective (as discussed in 
< The concept of ‘As Low as Reasonably Practicable (ALARP)’ is sometimes used for setting a value for acceptable risk. The basic idea behind this concept is that risk should be reduced to a level that is as low as possible without requiring ‘excessive’ investment. (Alternatively, the residual riskafter all reasonable means to reduce risk shall be as low as reasonably practicable.) Other terms that have the same general meaning are “As Low as Reasonably Achievable” (ALARA) and “So Far as Is Reasonably Practicable” (SFAIRP).
Due to the subjective nature of risk, no external agency, whether it be a regulatory body, a professional society or the author of a knol such as this can provide an objective value for ALARP. One large oil company, for example, has an internal ALARP guide that is over 30 pages long. Yet at no point in the document is any numerical guidance to do with acceptable risk provided. Nonetheless individuals and organizations are constantly gauging the level of risk that they face in their personal and work lives, and then acting on their assessment of that risk. For example, at a personal level, an individual has to make a judgment as to whether it is safe or not to cross a busy road. In industrial facilities managers make risk-based decisions regarding issues such as whether to shut down an equipment item for maintenance or to keep it running for another week. Or a manager may have to decide if a proposed change should be scrutinized through the use of a full Hazard and Operability Analysis (HAZOP) analysis. Engineering standards, and other professional documents, can provide guidance. Indeed, for well-understood risks in standard situations the application of industry codes and standards is generally sufficient to reduce risks to ALARP. But, regardless of what guidance is provided, at the end of the day, the manager has a risk-based decision to make. That decision implies that some estimate of ‘acceptable risk’ has been made.
ALARP and Safety Cases
For those assessing risk during the design of a facility, particularly those responsible for the preparation of Safety Cases, an important part of the Formal Safety Assessment (FSA) is setting a value for acceptable risk. Safety cases are basically non prescriptive, hence the duty holder not only has to calculate the level of risk associated with a facility, he or she needs to come up with some means of defining levels of acceptable risk.
Acceptable Risk Categories
Often risk values are placed into one of three categories: Acceptable, Marginal and Unacceptable. One company provided the criteria shown in Table 1 for its design personnel.
Table 1
Example of Risk Thresholds
|
|
Fatalities per year (employees and contractors) |
|
Intolerable risk |
>5 x 10-4 |
|
High risk |
<5 x 10-4 and >1 x 10-6 |
|
Broadly tolerable risk |
<1 x 10-6 |
Their instructions were that risk must never be in the ‘intolerable’ range. High risk scenarios are ‘tolerable’, but every effort must be made to reduce them to the ‘broadly tolerable’ level.
Figure 1, which is an FN curve family, shows the same concept of having three levels of risk. Boundaries of risk that are ‘definitely acceptable’ or ‘definitely not acceptable’ are established. Between those boundaries, a balance between risk and benefit must be established. If a facility proposes to take a high level of risk, then the resulting benefit must be very high.
Risk Boundaries
Risk Matrix
|
|
Consequence |
||||
|
Frequency |
|
Low, 1 |
Moderate, 2 |
Severe, 3 |
Very Severe, 4 |
|
Low, 1 |
D |
D |
C |
C |
|
|
Moderate, 2 |
D |
C |
C |
B |
|
|
High, 3 |
C |
C |
B |
A |
|
|
Very High, 4 |
C |
B |
A |
A |
|
Level of Investment
Once a level of acceptable risk has been set, then guidance as to investments in safety can be provided. If a risk is in the ‘intolerable’ range then it must be reduced, regardless of the cost. If such a reduction cannot be achieved then the operations or project must be stopped.
If the risk falls into the ‘broadly tolerable’ range then further investment in reducing that risk is not required (although it may be done if the cost is very low). It is when risk falls into the “High” range that the decision making becomes more tricky. The duty holder then has to show, through reasoned and supported arguments, that there are no other practical measures that could reasonably be taken to reduce risks further. Risks should be reduced to a level that is as low as possible without requiring ‘excessive’ investment or where the cost, effort and time to achieve further risk reduction are grossly disproportionate to the risk reduction achieved.
The above discussion leads to the following definition of ALARP that is used by one major oil company.
For any situation, there is a level of risk where it can be shown that the cost of additional preventative or protective measures is disproportionate to the risk reduction achieved. The work can proceed safely when the potential hazards, defined risks and intended control measures reduce the risk to the ALARP level.
When a risk is not well understood it should be analysed and assessed in detail before making the ALARP judgment. If the risks are still not well understood a more precautionary approach should be adopted when judging what risk reduction measures are reasonably practicable. The lack of evidence about the effects of a hazard is not a justification for taking no action to reduce risk. In general, hazards which have a high consequence should be scrutinized more carefully than those that have a low consequence.
Qualitative Guidance
The above discussions to do with ALARP have been based on quantitative estimates of risk. Either a value is estimated and provided as input to a risk matrix, or a full quantitative risk assessment is carried out. The estimated or calculated risk value is then compared to the acceptance criteria.
Another approach to determining ALARP is to use just qualitative measures for risk. Guidance such as that shown below can be used.
- Use of best available technology capable of being installed, operated and maintained in the work environment by the people prepared to work in that environment;
- Use of the best operations and maintenance management systems relevant to safety;
- Maintenance of the equipment and management systems to a high standard;
- Exposure of employees to a low level of risk.
De Minimis Risk
The notion of de minimis risk is similar to that of ALARP. A risk threshold is deemed to exist for all activities. Any activity whose risk falls below that threshold value can be ignored – no action needs to be taken to manage this de minimis risk. The term is borrowed from common law, where it is used in the expression of the doctrine de minimis non curat lex, or, ‘the law does not concern itself with trifles’. In other words, there is no need to worry about low risk situations. Once more, however, an inherent circularity becomes apparent: for a risk to be de minimis it must be ‘low’, but no prescriptive guidance as to the meaning of the word ‘low’ is provided.
Citations / ‘Case Law’
Citations from regulatory agencies provide some measure for acceptable risk. For example, if an agency fines a company say $50,000 following a fatal accident, then it could be argued that the agency has set $50,000 as being the value of a human life. (Naturally, the agency’s authority over what level of fines to set is constrained by many legal, political and precedent boundaries outside their control, so the above line of reasoning provides only limited guidance at best.) Even if the magnitude of the penalties is ignored, an agency’s investigative and citation record serve to show which issues are of the greatest concern to it and to the community at large.
RAGAGEP
With regard to acceptable risk in the context of engineering design, a term that is sometimes used is ‘Recognized and Generally Accepted Good Engineering Practice’ (RAGAGEP). Such a practice establishes engineering performance criteria based on established codes, standards and recommended practices.
The development of RAGAGEPs for a particular company or facility includes the following steps:
- Identify the relevant federal, state, county and local regulations;
- Identify local codes and standards (such as building and fire codes);
- Identify the pertinent industry consensus standards;
- Review all of the above with legal, safety and environmental staff;
- Incorporate proprietary experience and standards; and
- Finalize with engineering judgment.
The final step – the use of engineering judgment – can be hard to define. Basically, such a judgment should determine if the RAGAGEP ‘makes sense’ in the context in which its use is proposed, whether safety or environmental performance is truly enhanced, and whether regulatory exposure is reduced. A final and crucial step, in a RAGAGEP program is to ensure that it is kept up to date as new standards, regulations and practices are issued and adopted.
Indexing Methods
Some companies and industries use indexing methods to evaluate acceptable risk. Although a scoring system is used, indexing methods are basically qualitative. A facility receives positive and negative scores for design, environmental and operating factors. For example, a pipeline would receive positive points if it was in a remote location or if the fluid inside the pipe was not toxic or flammable (Muhlbauer 2003). Negative points are assigned if the pipeline was corroded or if the operators had not had sufficient training. The overall score is then compared to a target value (the acceptable risk level) in order to determine whether the operation, in its current mode, is safe or not.
Although indexing systems are very useful, particularly for comparing alternatives, it has to be recognized that, as with ALARP, a fundamental circularity exists. Not only has an arbitrary value for the target value to be assigned, but the ranking system itself is built on judgment and experience, therefore it is basically subjective. The biggest benefit of such systems, as with so many other risk-ranking exercises, is in comparing options. The focus is on relative risk, not on trying to determine absolute values for risk and for threshold values.
Difficulties with ALARP
A fundamental difficulty with the concept of ALARP is that the term is inherently circular and self-referential. For example, the phrase ‘best available technology’ used in the list above can be defined as that level of technology which reduces risk to an acceptable level – in other words to the ALARP level. Terms such as ‘best operations’ and ‘high standard’ are equally question-begging.
It may be for reasons such as these that the United Kingdom HSE (Health and Safety Executive) in the year 2006 decided to minimize its emphasis to do with ALARP requirements from the Safety Case Regime for offshore facilities. Some companies have also elected to move away from ALARP toward a continuous risk reduction model (Broadribb 2008).
