Vincent Ganthy
Principal Futures Systems Engineer, RSSB
Health and safety law in the UK puts a clear responsibility on employers: they must do what is reasonably practicable to protect the health, safety, and welfare of their employees. They also need to think about people who are not employed by them, such as passengers, contractors, visitors, or members of the public, and make sure they are not put at risk by the organisation’s activities.
Hence the famous phrase ‘as low as is reasonably practicable’ - or ALARP for short.
We spend a lot of time in rail making sure that the safety risks to which our employees, passengers, and customers are exposed are ALARP.
Risks or controllers of risks?
That sounds straightforward, and in many cases that works. In many day-to-day situations, focusing on risk rather than the control measure for that risk may not make much difference. If a control only deals with one particular risk, and does not really affect anything else, the assessment is fairly self-contained. For example, a measure to reduce noise exposure is unlikely to have much effect on a separate measure designed to prevent falls from height. Each can usually be considered on its own terms.
But there is an important nuance that is sometimes missed.
The law is not simply asking employers to reduce every single risk, one by one, to ALARP.
Rather, employers are required to carry out suitable and sufficient risk assessments so they can identify the measures they need to put in place. The risks are important but the ultimate focus needs to be on the measures to control the risks.
In other words, the key question is not just ‘How low can we make this individual risk?’ but ‘Is the control reasonably practicable, given its effects on one or more risks?’
Interconnected risks
The rail network has a great many interconnected systems and risks. So we need to consider what may happen when one measure affects several risks at the same time. This is where systems thinking, and the whole-system insight RSSB provides, really matters.
In a connected system, risks do not always sit neatly in separate boxes. One change in one part of the system can alter the risk picture somewhere else, sometimes in ways that are not immediately obvious. Managing network operations involves many linked parts, and introducing a control in one place can affect several risks at once.
Those effects might be direct, meaning they occur where and when the measure is applied. Or they might be more remote, appearing further along the line, later in time, or even after the measure is no longer being used. If these links are not recognised, a well-intentioned control could create unwanted consequences elsewhere in the system. Equally, an organisation might introduce a measure that turns out not to be reasonably practicable once the wider system effects are properly understood. We’ve recently explored the issue of risk mitigation in an interconnected system, modelling as an example the use of speed restrictions.
Same issue, different perspective
We need a wider awareness of the impacts our control measures may have on other parts of the network, especially those parts we aren’t intending to affect. In many instances that won’t change what we’ve been doing. But the nature and profile of risks are becoming more complex and unpredictable, and the rail network is becoming ever more interconnected. So we need to focus more on the impact of our control measures on risks across the whole system rather than on one individual risk, and adapt our control measures accordingly.