Systematic Assessment of Risk Control Effectiveness

The inherent risks associated with pipeline operations are significant. Companies dedicate countless resources to identifying, assessing, and controlling risks across their operations. Risk management activities are completed by personnel at all levels, from field staff to senior management. This ensures that risks are identified and managed at all levels within the company to align with company risk tolerance. Where risks are identified that are higher than company tolerance levels, additional controls are typically developed. For most risks, a series of controls is developed to protect in different ways or in different scenarios. In many cases, a control may protect against multiple different risks. When risk assessments are completed, there is the possibility that the effectiveness of controls that have been developed to manage the risk are incorrectly considered [1]. Individuals or teams completing the review of controls are assessing their effectiveness higher or lower than they actually are [2]. This is typically the result of a controls assessment that does not fully consider the functionality, availability, and reliability of the control. The result is the potential for a risk being accepted that may be beyond company risk tolerance or the allocation of additional resources on risks that are already well controlled. To account for a control’s partial effectiveness, they are often layered, with multiple controls working together to mitigate a risk [3]. In these instances, if one control is unable to manage the risk, another would be available to provide additional mitigation to reduce the possibility or consequence of a major risk event. With the combination of thousands of hazards that can lead to different major risk events with hundreds of unique controls, it can be difficult to quantify the degree of risk to which a company is exposed. This paper explores the approach to systematically assessing risk controls, enabling improved understanding and ability to communicate the overall organizational risk and prioritization of improvements for the most critical controls.