Guidance on health risk management assurance


This guidance is aimed at assurance practitioners, such as those who have responsibility for ensuring that health is effectively managed in the organisation, as well as ORR inspectors.

It covers approaches to ensure that the occupational health risk profile of an organisation is understood, and that appropriate assurance activities are in place. This includes the development of Health Performance Indicators.

In this guidance we have used two main approaches as part of the assurance process, as these allow a whole system perspective to be developed. 

These are:

  • Bow tie analysis to identify the health hazards inherent in an operation, and link those with the controls that are (or should) be in place to eliminate, control or manage those hazards; and
  • Management system evaluation (audit) using RM3 to establish the effectiveness and efficiency of the management system in controlling the hazards.

Figure 1 below provides an overview of a six stage approach to assurance. The last three stages form a management cycle once the first six steps are completed.

six stage approach to assurance diagram

You can find an outline of each step in the health risk management assurance model, and an illustrative worked example on the pages below. Additional information can be found here for Bow Tie Analysis and here for RM3.

In this section

Health risk management assurance: a guide to terms used

  • Assurance – A positive declaration that controls are in place and effective.
  • Bow tie analysis – a method used to model how causal factors of ill health can be controlled using controls/barriers.
  • Causal factors – linked to bow tie analysis, these are the factors that can cause occupational Ill health.
  • Control/barrier – the arrangements that are (or should be) in place to prevent the causal factor occurring, or those arrangements that mitigate the consequences.
  • Consequence – the result of the causal factor occurring. It can range from nothing, through to a fatality.
  • Critical – the barriers in the bow tie that are either essential to the prevention of a causal factor, or a barrier that is involved in the prevention of multiple failures.
  • Dual assurance – a concept in performance measurement, it refers to having measures that correlate to show the implementation and effectiveness of a tool.
  • Risk control system – the system in place to control health hazards identified within the organisation.
  • Threat line – the line on a bow tie diagram that links the causal factor to the point at which control in the system is lost.
  • Vulnerable – this refers to a barrier/risk control that is either very dependent on human performance, or relies on an engineering control that is either new or very old.