15.5 Risk Management
Key Takeaways
- The four risk management principles are accept no unnecessary risk, make risk decisions at the appropriate level, integrate risk management into operations and planning at all levels, and apply the process cyclically and continuously.
- The five-step risk management process is identify the hazards, assess the hazards, develop controls and make decisions, implement controls, and supervise and evaluate.
- The two primary levels of risk management are deliberate and real-time, separated at the point where planning transitions to execution.
- Effective mitigation reduces one of the three components of risk: probability, severity, or exposure.
- 'Knock-it-off' and 'Timeout' may be called by any Airman or Guardian regardless of rank without fear of repercussions, and cannot be overridden by command authority.
What Risk Management Is
AFH 1 defines it as "a decision-making process designed to systematically evaluate possible courses of action, identify risks and benefits, and determine the best course of action for any given situation." It enables commanders, functional managers, supervisors, and individuals "to maximize capabilities while limiting risks" in both on- and off-duty situations.
A job safety analysis is used "to evaluate each work task not governed by a technical order or other definitive guidance and when a new work task or process is introduced into the workplace." Supervisors are "in the best position to identify hazards, assess risks associated with those hazards, and correct unsafe work practices or safety deficiencies."
The Four Principles
"Four principles govern all actions associated with risk management," and they apply "24 hours a day, 7 days a week, 365 days a year by all personnel, for all on- and off-duty activities."
| Principle | What it means |
|---|---|
| Accept No Unnecessary Risk | All missions and daily routines involve risk, but unnecessary risk comes without a commensurate return in real benefits or opportunities. The most logical choices meet all mission requirements while exposing personnel and resources to the lowest acceptable risk. Critically: "we cannot and should not be completely risk averse" — even high-risk endeavors may be undertaken when there is a well-founded basis to believe the sum of the benefits exceeds the sum of the costs |
| Make Risk Decisions at the Appropriate Level | Some risk acceptance decisions must be made by an appropriate decision-making authority to effectively allocate resources and implement controls. Doing so establishes clear accountability. Leaders and individuals must be aware of how much risk they can accept and when to elevate decisions to a higher level |
| Integrate Risk Management into Operations and Planning at All Levels | Integrate as early as possible — this provides the greatest opportunity to make informed risk decisions. Risk assessments are most successful when incorporated deliberately in the normal sequence of events by individuals directly involved, and not as a last-minute or add-on process. "Risk management planning, even in a time-constrained environment, is better than no planning at all" |
| Apply the Risk Management Process Cyclically and Continuously | A continuous process across military training and operations, base operations, and day-to-day activities both on- and off-duty, used to continuously identify and assess hazards, develop and implement controls, evaluate outcomes, and provide feedback |
The most commonly missed nuance is in the first principle: AFH 1 does not say to minimize all risk. It says to accept no unnecessary risk, and explicitly permits high-risk endeavors when benefits exceed costs.
The Two Levels
| Level | AFH 1's description |
|---|---|
| Deliberate | May involve the full, formal application of the complete five-step process — thorough hazard identification, detailed data research, diagram and analysis tools, formal testing, and long-term tracking. May also simply involve normal day-to-day operations or activity planning using the same five steps with less time and resources |
| Real-time | A less formal risk assessment using basic RM process steps to identify and mitigate hazards in a new or changing situation. Founded on the five-step process, but streamlining the steps is essential where decisions must be made quickly |
"Deliberate and real-time risk management are interrelated... They are separated only at the point where planning transitions to execution of the mission or activity." That sentence is the cleanest statement of the distinction and a likely item.
In-depth risk management planning is a further variant of deliberate RM, generally associated with strategic-level planning, reserved for complex operations and systems, as well as high-priority and high-visibility situations in which hazards are not well understood or easily predictable — AFH 1's examples: large troop movements, airshow planning, or tactics and training curricula development.
The Five-Step Process
| Step | Name | What it involves |
|---|---|---|
| 1 | Identify the Hazards | A hazard is "any real or potential condition that can cause mission degradation, injury, illness, death to personnel, or damage to or loss of equipment or property." Review current and planned operations and tasks, identify and list hazards and factors, and list the causes associated with each hazard, trying to identify the root cause |
| 2 | Assess the Hazards | Apply quantitative or qualitative measures to determine probability and severity. Evaluate time, proximity, volume, or repetition to determine exposure; determine severity in terms of potential impact on personnel, equipment, or mission; determine probability; and determine the level of risk |
| 3 | Develop Controls and Make Decisions | Develop and select specific strategies and controls that reduce or eliminate risk. Start with the highest-risk hazards, identify as many control options as possible, prioritize them, select those reducing risk to an acceptable level, and analyze whether the benefits now exceed the level of risk |
| 4 | Implement Controls | Develop an implementation strategy identifying who, what, when, where, and how much cost. "There must always be accountability for acceptance of risk regardless of circumstances." Provide a roadmap, a vision of the end state, establish accountability, provide personnel and resources, and deploy a feedback mechanism |
| 5 | Supervise and Evaluate | Leaders ensure controls are sustained over time — supervise and monitor, then review and evaluate to ensure risk and cost are in balance. After-action reports, surveys, and in-progress reviews are excellent tools, and a feedback system must be established to confirm corrective action was effective |
The risk assessment matrix in Step 2 combines probability of occurrence with severity, with levels ranging from "extremely high" (frequent exposure and catastrophic effects) to "low" (unlikely exposure and negligible effects). The full description is in DAFPAM 90-803, Risk Management (RM) Guidelines and Tools.
The three components of risk appear in Step 3 and are a reliable item: "Effective mitigation measures reduce one of the three components (probability, severity, or exposure) of risk."
Also in Step 3: "There is no 'cookie-cutter' approach or specific standard for establishing levels of risk management decision authority across the DAF. The higher the risk, the higher the decision level needs to be."
Real-Time Risk Management
Real-time RM applies "when a planned activity is already underway or when the complexity or perception of overall risk is low."
A complete assessment requires three stages of situational awareness in a relatively short time:
- Perception of what is happening
- Integration of information and goals
- Projection into the future
Developing controls in real time means considering all available controls (resources). AFH 1's examples of controls that function as "layers of protection": having a good understanding of the situation, being properly trained, wearing correct personal protective equipment, knowing personal limitations, and having a "Wingman" to support their efforts.
On communication under stress, AFH 1 is specific and testable: "Perception and communication skills are adversely affected as individuals become increasingly stressed and lose situational awareness." In high-stress situations, "communication skills diminish as individuals channelize attention and lose awareness of the overall situation. They can experience tunnel vision and be unable to multitask effectively."
Questions to ask before implementing a real-time mitigation: "Who needs to know about the situation?" "Who can help or assist?" "Who can provide back-up?" "Can this be done differently?"
A caution worth remembering: real-time RM "relies on the individual or small group taking immediate or near immediate action," and "this aspect alone can make Real-Time Risk Management decisions riskier than deliberate RM decisions."
And the abandonment option: "all Airmen and Guardians must consider the possibility of abandoning the mission or activity if the situation appears too risky or too costly to continue" — particularly when there are no reasonable options to change the circumstances in the time remaining.
Debrief questions AFH 1 supplies for Step 5: "Was our assessment accurate?" "Were we lucky?" "How well did we use the controls and resources?" "Was the communication effective?" "What can we do to improve the events in the future?" — "Were we lucky?" being the one that distinguishes a real debrief from a self-congratulatory one.
Knock-It-Off and Timeout
These concepts are "integral to Real-Time Risk Management" and exist "to ensure that all personnel have a voice in any situation to identify concerns or to inform others of a developing hazardous situation." Verbalizing either term "sends a message to those involved in a specific action to stop, take a moment to reset, and reevaluate the current situation."
The four key aspects — and the second one is the most consequential fact in Section 17F:
- All Airmen and Guardians, regardless of rank or position, are empowered to use these terms without any fear of repercussions
- When either term is used, all current actions are immediately halted and the situation is stabilized to a safe position — "this is nonnegotiable and cannot be overridden by command authority"
- After the call, a clear determination is made whether the current action may be continued safely, requires change, or must be terminated
- The alerts do not prevent actions from continuing once safety and risk concerns are addressed, but provide all personnel an avenue to effectively mitigate risk through immediate intervention
"Cannot be overridden by command authority" is exceptional language in AFH 1 — almost nothing else in the handbook is described that way. Expect at least one scenario in which a supervisor or higher-ranking member tries to wave off a Knock-it-off call; the keyed answer is that the actions halt regardless of who called it.
A Senior Airman calls 'Knock-it-off' during a maintenance evolution. A Master Sergeant present believes the concern is unfounded. What does AFH 1 require?
Which three components of risk can effective mitigation measures reduce?
How does AFH 1 characterize the first risk management principle, 'Accept No Unnecessary Risk'?