Risk Resolution Process

9.7 – Risk Resolution Process

9.7.1 Purpose

To contain and mitigate risk of regulatory, legal, customer and business issues that could or have impacted TLM.

9.7.2 Scope

All Low, Medium and High Risk identified on the risk register (Ref 9.6 Identification and Management of Risks).

9.7.3 Responsibilities

Risk Resolution Owner – Delegated by the Chief Moderator

Chief Moderator – Ensuring identified risks are reasonably mitigated

– Process Owner

All Employees – Support Risk Resolution Owner as required

– Potential Risk Resolution Owners

9.7.4 Documentation and Forms

“Risk Resolution Report”

9.7.5 Procedure

If the risk has been realised, i.e. has occurred, start at step 1, complete then move to Step 2.

If the risk is a potential risk, i.e. has not occurred yet, start at step 2.

Step 1 Realised Risk (Actual)

Follow the 3C’s below and document in the 3C report.

The 3C Process

Confirm

Test, revisit, check, examine as necessary, that the risk is real. Define the Risk in as much detail as possible.

Communicate

Based on the nature of the risk and the level of Severity, inform all affected parties. Ensure all those required to confirm the ‘Risk’ are included and all necessary TLM personnel.

Contain

Take steps to immediately limit/remove the impact of the risk. Depending on the nature and the severity of the risk the steps to do this should include the generation of a working group to develop an action plan, the participants in the working group will depend on the complexity of the risk, this should then be progressed to an expedient resolution.

Once the Risk has completed the containment phase, the 3’C’ section of the ‘Risk Resolution Report’ should be completed.

Step 2 Realised Risk & Risks above ‘Reasonable Risk’

Determine the appropriate method from the below, ‘Just Do’ and 5I’s.

‘Just Do’ is intended to cover risks that have very simple or obvious process changes to mitigate them. It is important however not to make assumptions.

The 5I approach is a more involved approach where the Cause / Contributing Factors are less obvious.

The ‘Just Do’ Method

Used when experience and or knowledge of the risk concerned has an obvious resolution.

Introduce the obvious resolution into the relevant controlled procedure using 9.3 – “Change and Update of Controlled Procedures”.

Ensure users of the relevant controlled procedures are competent to use the updated procedure.

Inspect Monitor the effectiveness of the resolution / mitigation introduced, over a period of time and range of scenarios, that will be reasonable in establishing the expected result. Update the competency matrix as necessary (9.1- Internal Training and Competence Procedure).

The ‘5I’ Method

Used where the resolution / mitigation of a risk is not obvious o complex. Follow the 5I’s below and document in the 5I report.

Investigate Risk Owner is required to accurately state the nature of the risk, and lead an investigation into understanding what is causing a realised risk or could cause a potential risk to be realised. Using appropriate tools, such as:- ‘Walk The Process’, ‘Scenario Recreation’, ‘Cause and Effect’, ‘Brainstorming’, Data Stratification, isolate the causes and / or contributing factors.

 

Identify From conclusions made in the investigation the Risk Owner must clearly state the Root Cause and / or contributing factors.

Invent Develop step(s) that will ideally prevent the risk from recurring or being realised at a future date, or at least reduce to a ‘reasonable risk’. If the steps are not easily determined, assemble multi-disciplined groups to ‘Brainstorm’, or employ the use of outside expertise to support the development of the step(s).

Introduce the resolution or mitigating step(s) into the relevant procedure using 9.3 – “Change and Update of Controlled Procedures”.

Ensure users of the relevant controlled procedures are competent to use the updated procedure. ‘Read across’ – introduce this corrective action where similar Root Cause and / or contributing factors could generate further occurrences of the same type of risk.

Inspect Monitor the effectiveness of the resolution / mitigation introduced, over a period of time and range of scenarios, that will be reasonable in establishing the expected result.