1. Risk based inspections: Criteria, Planning and Implementation Donald Macrae, WBG Consultant Inspection Reform Conference, Amman, 3 June 2014 Day 2, Session A-1

2. The Overall Risk Process (ISO 31000) 2 (ISO 31000 is not mandatory but is as good a start as any.)

3. Start with values and priorities ♦ Everything flows from the public values being protected by the regulatory system. In conjunction with the policy Ministry, identify sectoral priorities and then identify hazards facing these priorities. ♦ These values and priorities drive the whole process “Risk” is not a value in itself but a way of protecting these values and priorities. Don’t start by trying to identify “risks”. They follow on from hazard analysis. ♦ “Hazard” is the damage to be avoided whereas “Risk” is the probability it may happen.

4. Example – Labour Safety Value – human life and safety Hazard – workplace accidents Risk – falling from height Risk criterion – working at height. So, a business that involves workers working at height presents a risk to be inspected.

5. Risk Assessment Risk Identification Comes from Hazard Analysis Risk Analysis Analyse nature of damage, extent of damage and probability Risk Evaluation Score each element of the analysis

6. Example – Labour Safety (2) Risk assessment of business Inherent danger in type of business: construction industry (10 points) Extent of danger: 250 workers on site (8 points) History of business: no accidents in 240 days (2 points) Total score: 20 points The scores come from risk assessment carried out by experts in the sector, allowing a business to be scored.

7. Expert Risk Assessment ♦ The risk process is easy to describe. The complexity comes in the analysis and evaluation. This may need scientific research and complex analysis, e.g. import risk of pathogens, but that can then present the inspector with a scorecard to apply to a particular business. ♦ The “risk assessment” is not done by the inspector except insofar as the inspector observes the business against the scorecard and adds up the numbers. The expert work is done in setting the scores, which derive from the risk criteria and, ultimately, the sectoral priorities. ♦ So, each business can be given an overall risk score for each sector. (It may have very different scores for different sectors.)

8. Planning according to Risk 8 A business is given an overall score for level of risk. The planners then look at the range of scores. High, Medium and Low Risk are relative categories, not absolutes. A score of 130 does not mean H, M or L. It depends on whether some got 240 and some got 35. It has to be relative because planning is allocating a scarce resource and it has to go to where it is most needed, not just where it may be needed.

9. High Risk Medium risk Low risk The Planning Pyramid Inspect Frequently Inspect rarely Inspect very rarely or not at all Scores 100 50 0

10. Checklists – Risk-based inspection When the inspector carries out an inspection, he follows a checklist of issues, not the original regulations. The checklist prioritises the regulatory issues according to risk. In law, no one regulation is more important than another but, in reality, there can be a big difference. Some rules don’t matter. Its too narrow. It should be 2 millimeters more @*# %

11. But inspection is only one risk treatment strategy Tolerate Share Mitigate Avoid | Robust enforcement of bans on products and activities | Risk-based inspection, based on High/ Medium/Low Risk objects | Compliance Management, Consumer Awareness and Information, Campaigning | Self-regulation by Industry, Voluntary Standards, or deferring risk treatment to a later stage, e.g. contingency planning.

12. Thank you for listening. Donald Macrae Donald@dmacrae.co.uk Dmacrae@ifc.org