Assess inherent and residual risk

A hazard’s risk is calculated as likelihood × severity, looked up on your org’s risk matrix. SteadyOn does this twice: once for inherent risk (no controls applied) and again for residual risk (with your current controls).

Steps

1. Open the hazard, or create a new one.
2. Switch to the Assess tab.
3. Pick an Inherent likelihood — Rare to Almost certain. This is with no controls in place. Be honest.
4. Pick an Inherent severity — Insignificant to Severe.
5. SteadyOn shows the Inherent risk level below the picker, looked up on your matrix. The default 5×5 matrix maps the corners as Low (Rare × Insignificant) and Very high (Almost certain × Severe).
6. Switch to the Control tab.
7. Add your controls (see Add controls).
8. Pick a Residual likelihood and Residual severity — these should reflect the world with the controls in place.
9. SteadyOn shows the Residual risk level. This is what BRAG uses to decide if the hazard is currently worth worrying about.

Tips

• If residual risk equals inherent risk, your controls aren’t really doing anything. That’s a finding worth raising as an action.
• Residual likelihood often drops by one or two steps with good engineering controls. Severity usually only drops with PPE or emergency response (e.g. eye-wash stations near corrosives).
• Don’t lower likelihood and severity at the same time unless your control genuinely does both — e.g. eliminating the chemical reduces both, but training people to use it mainly reduces likelihood.

See also

• The hierarchy of controls — which kinds of controls reduce likelihood vs severity.
• Customise the risk matrix — change the matrix if 5×5 doesn’t fit your org.
• Default risk matrix — what ships out of the box.