Skip to content

Controls Design and Controls Assurance for WHS. WHS series session 8.

Protecht’s eleven part complimentary webinar series focusing on a comprehensive deep dive into Workplace Health and Safety (WHS), kicked off on 23 July 2020. Click here to join the upcoming remaining live sessions in this series.

In the 8th Webinar in the series we looked at the importance of Controls Design and Controls Assurance for WHS.

Objectives of Controls Design and Assurance

There are 5 Objectives of Controls Design and Assurance:

1. Design an optimal set of controls to achieve a risk level "As Low As Reasonably Practicable" (ALARP)

2. Design controls with optimal cost benefit. This also achieves lower risk.

3. Provide reasonable assurance as to the design and operating effectiveness of our current controls.

4. Identify control gaps and control weaknesses so that they can be remediated.

5. Comply with regulatory requirements.

In the ISO 31000 standard, controls design and assurance are primarily covered by process steps 6. Risk Treatment and step 7. Monitoring and Review. In the ISO 45001 standard, controls assurance is covered by section 8. Operations, in particular section 8.1.2 The Elimination of Hazards, and section 9. Performance Evaluation, in particular section 9.1.1 Monitoring, Measurement, Analysis and Performance Evaluation.  

As we have discussed in previous Webinars, we are passionate about integrating WHS into the overall Enterprise Risk Management (ERM) process. The WHS controls process falls under the ERM Controls Assurance process.

In our first poll, we were interested to find out if our Webinar participants had a formal ongoing controls assurance program in place. We asked 'Do you have a formal ongoing controls assurance program in place over your WHS critical controls?'

  • 45% of participants do have a formal program.
  • 32% of participants do not have a formal program.
  • 23% of  participants have a formal program in development.

It is reassuring to see that nearly half of our webinar participants do have a formal program in place over WHS Critical Controls. 

WHS Webinar 8 Poll 1


Controls Design: Objectives & Design Considerations

In the webinar we explored the importance of controls design to enable it to achieve the control objectives. The design of the control is crucial.

Control design effectiveness assessment assesses the degree to which a control's design allows it to meet the control objective(s). A control can never be better than how it is designed!

The starting point is to articulate the control objective. At Protecht we have developed the following guidance in order to articulate a control objective. The control of ear protection has been used as an example.

  • Use the Control Type.  i.e. To prevent,
  • Reference the Risk to which the Control relates.  i.e. the risk of hearing damage
  • Define what the Control is expected to do to the Risk. i.e. by reducing the likelihood of hearing damage
  • Define what the Control specifically does. i.e. by protecting the ears by placing a noise reducing barrier between the noise and the ear.

In our second poll we asked 'Do you formally record the control objectives of your critical controls?'

  • 71% of participants do formally record the control objectives of their critical controls.
  • 29% do not.

WHS Webinar 8 Poll 2

When considering Treatment Effectiveness methods in Risk Management, we consider the following 7 possible responses to a Risk:

  1. Accept the Risk. We would do this when it has been reduced to ALARP
  2. Transform the Inherent Risk. (Process re-engineer)
  3. Improve Controls.
  4. Transfer/Share the Impact. (relevant only for financial loss)
  5. Accept the Risk. (formally)
  6. Avoid the Risk.
  7. Reduce Controls. This would be considered only where we had gone past the point of ALARP.

If we relate this methodology to the WHS Hierarchy of Controls,  "Elimination" at the top of the hierarchy is not a control but equivalent to avoidance.  Next, "Substitution" is not a  control but reflects transformation of the risk. Controls are reflected more in the Administrative, Engineering and PPE parts of the hierarchy.   

Using Bow Tie Analysis, a concept that we have explored throughout this webinar series, we can identify our control types and the impact of the controls on likelihood and impact. This helps us to determine our control objectives and ensures that it is more proactive, as we know "prevention is better than cure."

Controls Assurance: Control Testing

Once we are happy with the design of our controls, we need to  provide ongoing controls assurance that the controls are working effectively.

In Risk Management, we often use the 5 by 5 Risk Matrix to assess the effectiveness of controls. We can also use Bow Tie Analysis again to assess our controls effectiveness, individually or as a group covering all controls related to the risk. 

At Protecht we follow a particular methodology to ensure control effectiveness. We recommend doing design effectiveness testing first, then operational effectiveness and combining them for an overall effectiveness rating.

With this in mind in our third poll we asked 'Do you test Design and Operating effectiveness separately and then combine them for an overall effectiveness rating?'

WHS Webinar 8 Poll 3

  • 28% of participants combine the two for an overall effectiveness rating
  • 72% of participants test the design and operating effectiveness separately 

Controls Assurance: Dynamic Monitoring

As explored in previous webinars, Protecht is passionate about dynamic monitoring and reporting. This provides an an integrated, dynamic view of our controls. With that in mind, we were interested to find out how our Webinar participants are currently 'using automated continuous monitoring of controls?'

WHS Webinar 8 Poll 4

  • 58% of participants are not using automated continuous monitoring
  • 42% are partially using 
  • 0% are using automation comprehensively

These results are promising, I encourage more of you to start using more automated and continuous monitoring of your controls, this monitoring will allow for aggregation and more insight in your reporting.

Reporting & Communication

In the webinar we looked at some examples of aggregated and proactive reporting, the ultimate being the Protecht Risk in Motion reporting and for WHS Safety in Motion reporting. In the 10th & 11th Webinar of this series we will be exploring these dynamic visualisations in more detail.

I was interested to know how the webinar participants are currently recording and reporting on Controls Assurance testing:

WHS Webinar 8 Poll 5
  • 32% of participants are using a variety of informal systems
  • 32% of participants are using a dedicated WHS system
  • 5% have a formal dedicated part of an ERM system
  • 32% don't have a formal controls assurance process

As we have explored through this series, at Protecht we are passionate about integrating WHS with Enterprise Risk Management (ERM) to give a true consolidated organisational view of risk. These results whilst encouraging show that we have some way to go in developing a strong, integrated and efficient and effective controls assurance process. 

In our next webinar we will continue our deep dive into WHS by looking at WHS Compliance and Compliance Risk Management.

To access the recording of the previous webinars and to save your spot for the upcoming webinars click the image below:

WHS webinar CTA


About the author

David Tattam is the Chief Research and Content Officer and co-founder of the Protecht Group. David’s vision is the redefine the way the world thinks about risk and to develop risk management to its rightful place as being a key driver of value creation in each of Protecht’s clients. David is the driving force in driving Protecht’s risk thinking to the frontiers of what is possible in risk management and to support the uplift of people risk capability through training and content.