Risk control and compliance

What are the complications of applying risk control principles to the problems stemming from the Covid-19 pandemic? Dr Albert Mushai and Professor Robert Vivian address the issues.

Historically, the earliest approach to dealing with accidents and diseases was via legislation – in particular, regulations applicable to things. Consequently, extensive regulations, such as machinery regulations, came into being to deal with things.

More controversially, legislation then expanded to cover issues, such as conditions of employment. Legislation was passed to limit the number of hours per day one could legally work. Other regulations sought to limit work to be done by women and children.

By the 1960s, doubts started to arise about the effectiveness of regulations as a successful risk control technique. This was the case in South Africa and elsewhere. There was a realisation that regulations could indeed exist, but did companies actually comply with these regulations? As a result, risk control took on a distinctive managerial flavour.

The system favoured in South Africa was management by objectives (MBO). Accordingly, a number of objectives were set, with inspection audits conducted against them. This produced a significant improvement over the regulation-based system.

Oddly enough, regulations per se did not form the focal point of the MBO system. It was possible to meet the safety objectives but at the same time to not comply with the regulations. This is not to say that the MBO system did not have a very positive impact on regulatory compliance: where the safety system was well managed, the degree of regulatory compliance also improved.

It is possible to identify the applicable regulations. Take, for example, the machinery regulations. There are regulations governing items such as ladders, slings and grindstones, and so on. Each of these regulations is very detailed. The various items would need to be inspected and checked to see if they complied with existing regulations. The regulations would therefore need to guide the development of a checklist and someone would have to be appointed to inspect the items against the regulation-governed checklist.

However, in most cases, the person who inspects the items will need to be skilled in handling the items for inspection. For example, the inspection of a sling requires a qualified rigger. Thus, the person responsible for the inspection will also need to be identified. And it would also be necessary to certify that he/she is qualified and trained to carry out the inspection.

Furthermore, it is important to know that the inspection actually takes place – so a record would have to be kept. It is also clear that the inspections would need to be done on a regular basis. It will not be adequate to merely say that “these things were inspected at some time”. So, the extent and complexity of the task become clear:

• Every piece of legislation including regulations needs to be identified;
• Every piece of legislation needs to be converted into a checklist;
• Every item subject to the regulation would have to be identified and physically marked so these can be identified;
• Individuals would have to be certified as competent to carry out the inspection;
• These individuals would probably have to undergo training to be certified;
• The inspections would have to be carried out;
• These inspections should be predefined to match each regulated item;
• A programme needs to be in place to ensure all of these tasks take place; and
• Detailed records need to be kept on file.

Despite all of these tasks, the system may well fail. Take two examples. In a case involving a nuclear power station it was a requirement that certain readings had to be recorded. The readings were collected and all seemed well. But running a nuclear power station rests on strict security processes. Every time someone went through a door the action was recorded. The security manager noted that the employee who took the readings never in fact opened the door leading to the place where the readings needed to be taken. When asked why he didn’t do so, the employee replied his leg had been hurt, so he merely wrote down the previous readings.

In the other example, employees sometimes had to work in a confined, oxygen-filled space. There are detailed regulations that govern this. One requirement is anyone working in the space cannot take any ignition source with them. The regulations were adhered to under the strict supervision of the safety officer. Then an accident happened. Someone took matches into the space and was killed in the ensuing fire.

Having the system in place did not prevent the loss of life. The irony is that the person who did not follow the system and was killed was the safety officer.

These examples show that having expensive and extensive regulations does not solve many of the failings within a given system or setup. Accidents still occur despite the existence of detailed regulations.

These two examples demonstrate another point. The regulation system relates to physical items (ladders and slings for example), but it was human error that resulted in the failure of a defined procedure. Failings of these nature cannot be detected from inspections.

In most cases, and certainly from what we have seen during the pandemic, people tend to assume that the solution to any problem lies in regulations. Evidence shows that this assumption has significant limitations. Problems arise when a system is heavily dependent on compliance with regulations. In the next article, we will examine these problems with specific reference to the recently promulgated Covid-19 regulations.