Managing Risk or Assessing Risk: Do You Know the Difference?

Risk assessment follows six elements that work together to reduce the likelihood of a risk occurring — not to eliminate something already known to be inevitable.

• Identify the element upon which risk exists — what could cause you problems?
• Assess the likelihood of the risk, using a method similar to WHS teams in your workplace.
• Plan to manage or remove the risk from existence. You need a road map before you begin.
• Implement the plan you have devised to remove or mitigate the risk.
• Monitor your results. This is critical and the element you need to manage upwards.
• Control your risk by using the results to change or enhance your efforts further.

The aim is to reduce the likelihood of the risk occurring, rather than to eliminate something that is already known to be inevitable.

Risk management has four main stages in its cycle, designed for problems you already know will occur.

• Plan or identify the risk at hand, first and foremost.
• Assess the risk by categorising it — this is really important in risk management.
• Handle the risk by either removing it or implementing a risk aversion tactic.
• Monitor and report on the risk so you understand the probability and impact over time.

Known vs uncertain risks

Risks come in several forms, including financial, health and safety, infrastructure impact, and systems impact. Whatever the risk, there are two ways to look at it: will it possibly happen, or is it going to happen?

If you know it will happen, you need to risk manage the problem. The order of preference is to first manage the risks you know will occur, then turn to the uncertain ones. Once you reach risks that may occur, you can risk assess them and work through an order of priority.

Many people get hung up on safety-related events such as injuries. Yes, it is a tragedy when anyone gets hurt in the workplace or worse. But if something has not been risk assessed, it may simply mean no one knew the event could occur. No one knows what they don't know — so don't feel threatened if something unforeseen was not first risk assessed.

What happens after an event matters most

Once an injury or safety breach does occur, it should automatically be placed through a risk management process. It may not be executed right away — other risks may take priority — but it is something that needs to be managed, not assessed for its likelihood of occurring. The event has already happened; the focus is now on impact and prevention of recurrence.

Risk assessment also doesn't have to be confined to the production floor. It can be extended into vendor purchase agreements, service level agreements, and other commercial arrangements. The level of consideration depends on the impact an element will have on your business.

Within your supply chain, there are a few quick things you can do to improve your business:

• Build and maintain a working risk spreadsheet and share it with your team.
• Cost the risk or assign a score, then work on the worst offenders first.
• Raise risks with your peers and management team — working as a group is a force to be reckoned with.
• Revisit the list often — say once per week — to see how you are tracking.

These simple habits help ensure risks do not sit silently with one person. Shared visibility is what turns a list into a working control.

Adding known risks to your register

If you want to stand out as a supply chain leader, adding a known problem to a risk management spreadsheet — with an attributed cost — goes a long way, provided you then mitigate it. If you are unsure of when the risk will occur, place it on your to-do list as a secondary priority.

Corporate derivative liability applies where an executive knew, or ought reasonably to have known, of the conduct constituting an offence — or that there was a substantial risk the offence would be committed.

The Fleurieu case

The owners of the Fleurieu tourist company referenced in the original article should have known about the risks within their organisation and allocated suitable budget and resources to prevent an issue arising from one of their truck drivers speeding. Proper Chain of Responsibility training would have helped prevent the 'unknown' in this case, giving the business the opportunity to fully understand its risks and reduce its liability under the Act.

For executives and managers, CoR training tailored to your role is a practical starting point. Understanding the difference between risk assessment and risk management is part of meeting the due diligence expectations placed on officers under both HVNL and WHS law.

MAEZ helps Australian businesses turn Chain of Responsibility, HVNL, WHS, transport safety, and chartered risk obligations into practical training, advisory, audit, and implementation pathways. The approach is straightforward: find the gaps, fix the system, and prove the controls.

MAEZ helps transport operators deal with the compliance risk they already know is there — getting the Safety Management System in order, protecting NHVAS accreditation, reducing fine exposure, and connecting training and evidence workflows.

Where software is the right next step, CoRGuard supports the evidence workflow — records, reminders, diaries, audits, document control, inductions, corrective actions, and evidence reporting. For a practical review of the controls, evidence, training, and SMS gaps that matter most to your operation, contact MAEZ.