Critical Controls: What Keeps You Up at Night?
Today's post on safety assurance will focus on identifying and measuring critical controls.
Checking an entire system of controls is a big job. Reporting on those checks would be an even bigger job and not necessarily a welcome thing if your senior management is as busy as mine. The company I work for employs a criticality filter to focus our accountability on those activities that mean the most.
This article is going the explore both why you might want to use criticality and how you might apply it to your long list of controls.
How Do You Manage a Deluge?
Anyone who has dealt with a large spreadsheet knows about filters. Power users of Excel or Numbers will have used them to their advantage and, if they have done it in front of others, have probably earned themselves a few admirers.
But even the most tech-noob amongst us is using filtering all the time. Human perception filters out, supposedly, unneeded data automatically either to allow us effectively operate or because our body is suffering under stress (think, tunnel vision leading passing out when subject to G-force).
As stated above, a criticality filter can take your lists of (potentially hundreds of) controls down to 3-10 and if this list if truly your most importance risk control activities, then now you have the time go into depth on these controls and then report up to your Accountable Executive in a way that they can digest, comprehend and articulate, if required.
Pick Your Favourite Child?
Once you've accepted that you need to choose some of your control activities for special attention, now you need to pick them. This is probably the part of the process where things have the potential to become contentious and to be stalled.
The primary piece of advice given to me when I was first introduced to this approach was to consider "what controls, if not working properly would keep me up of night?" At that time, I was still new in my job, so I have a few things I wanted to change and these kept me up at night already - so it was easy.
But having been through the process now, I have developed some other guidelines to help identify the critical aspects of your operations. They are proactivity, persistence and multi-purposes.
Proactive Controls
Don't rely on a trigger to be enacted/implemented. Obviously, this applies to activities like habitat control (grass management) and serviceability inspections.
Persistent Controls
These are ones that are always there during operations. Passenger screening and approach slope guidance lights are good examples having this quality.
Multi-purpose Controls
These are signal activities that address two or more hazards/risks. A perimeter fence is a great example of this as it address both the safety risk of animals and the security risk from agents with intent.
Don't Forget Context
As with nearly everything in the field of safety management, a definitive answer on critical controls cannot be given. Because your context will be different to mine, and even mine is changing over time.
The matrix below shows the critical controls I've been working with for the last year but they are under review at the moment.
Example Airport Critical Control Matrix (CC) Dan Parsons
Given I think that this is a contentious topic, I'd love to hear your point of view in the comments below.
In part 3, we'll go into what you do with these critical controls through the development of a standard against which your audit/review is conducted. Part 1 provided an overview of Safety Assurance.
Image credit: Vitor Azevedo
