Development and Introduction of the Risk-Sentience Auxiliary Framework (RSAF) as an Enabler to the ISO 31000 and ISO 31010 for High-Risk Environments

Abstract

The aim of this study was to develop, implement, and evaluate a new auxiliary enterprise risk management framework and process to serve as an enabler to the global ISO 31000 risk framework and ISO 31010 processes. This framework has been designed particularly for use within high-risk environments and those characterized by volatility, uncertainty, complexity, and ambiguity (VUCA). This paper proposes a methodology for optimization of structured sharing and grass-roots management of all available risk-sentience information with the assessed potential to develop into an identifiable risk in the future. The author introduces new risk terminology including risk-sentience, risk-sentience information, and risk-sentience management. The process involved the development of the Theory of Risk-Sentience (ToRS), Risk-Sentience Auxiliary Framework (RSAF) and a risk-sentience management process referred to as LUOMEAR (Learning from Uncertainties, Others Mistakes, Experiences and Anecdotal Reporting). Manchester Patient Safety Framework (MaPSaF), SWOT (Strengths, Weaknesses, Opportunities, and Threats) analysis, and a newly developed Risk-Sentience Fertility Checklist were used to conduct pre and post-trial evaluations. The findings include positive adjustments in safety culture, components of commitment to quality, communication and team-working around safety issues, access to evolving risk-information, and efficient sharing and management of recorded risk-information. Recommendations are made for more extensive application of both the proposed auxiliary risk framework and process within high-risk sectors to further explore its effectiveness and scope.

1. Introduction

It would be considered a rational argument to state that the focus of organizations possessing either pro-active or generative safety cultures would be on early and robust risk management, rather than by merely prioritizing incident management processes post-occurrence of adverse events. However, such an argument would be based on the presupposition that it is generally acceptable to wait for the prospect of an event or uncertainty to evolve into the form of an identifiable risk before effectively addressing it. However, within the context of high risk and volatile environments (e.g., counter-terrorism, systems engineering, oil rigging, complex surgery etc.) this waiting period of inaction could be the incubation stage of rapidly evolving risk-information which could potentially result in severe and long-lasting consequences. The question arises then, can evolving risk-information be better addressed at grass-roots level even prior to becoming an identifiable risk?

It has also been observed in organizations that risk management procedures fail to gain support from non-management employees due to a variety of reasons: ineffective communication from senior management, difficulty in establishing a risk-based work culture, or uncertainty over the purpose of their participation in the risk management process (Summerill et al. 2010, pp. 4319–27). While the senior management employee’s role is clearly established within the ISO 31000:2009 framework, the role of non-management employees is not specified at all. This usually manifests in a problematic detachment between the senior management and non-management employees which is not conducive to establishing a robust risk culture. Furthermore, the absence of personal values and ethics within the ISO framework, though they are recognized to have a bearing on risk-perception (Slimak and Dietz 2006; Weber et al. 2002), gives credence to the possibility that the framework has further scope to be improved on. The ISO 31000: 2009 which sets out the global best-practice benchmark for enterprise risk management appears to have covered several aspects of efficient risk management in theory. In practice, however, it has been open to debate whether its approach relating to the concept of uncertainty is appropriate (Prpić 2016) and whether the potential for achieving support and feeling of ownership of the risk management process within the non-management employee category is realistic within the framework. According to the ISO 31000, risk is defined as the effect of uncertainty on objectives (ISO 2009a). With uncertainties being identified as the singular causative factor for all risk, it would be a reasonable expectation that addressing uncertainties would feature prominently within the core ISO framework, but that is not the case. It is also worth reflecting that uncertainties and other risk-information which can be addressed are only those which we are made aware of, indicating the vital need for a robust process to obtain such evolving information on an ongoing basis.

Aims and Context

The aims of this study were to develop, implement, and evaluate a new auxiliary enterprise risk management framework and process to serve as an enabler to the ISO 31000 framework and ISO 31010 processes (ISO 2009c), and thereby address the key deficiencies within the ISO model as highlighted by critics. These aims were envisaged to be achieved by optimizing structured sharing and management of all evolving risk-information which had identified potential to develop into a future risk, with secondary objectives of improved safety culture and engagement from non-management employees within the auxiliary risk-management process. The context of this study was in a community occupational therapy department within a major Irish public health service organization which had adopted the ISO 31000 and ISO 31010 risk principles and processes. The community occupational therapists included in this study were exposed frequently to high-risk patient issues such as pressure ulcer development, serious incidents relating to the use of hoists/wheelchairs, and complex seating assessments, all within the context of lone working in the community which further exacerbated the risks. This paper initially details current relevant literature and possible deficiencies within the ISO 31000 framework, introduces the Theory of Risk-Sentience and the development of an auxiliary risk management framework, a risk-sentience management process, and a checklist. It then describes the pilot implementation of the proposed framework and process along with its evaluation, discussion of results, and potential applications within various sectors.

2. Literature Review

A review was conducted to ascertain the current schools of thought in relation to global risk and uncertainty management strategies, frameworks, and processes. This information was utilized to develop and design a supplementary risk-framework and process by building on the experiences and critique of the current ISO 31000 risk framework.

2.1. Managing Uncertainties in Risk Management

Some challenges relating to ISO 31000’s handling of the concept of uncertainty are based on prominent author Frank Knight’s analysis within his seminal work ‘Risk, Uncertainty and Profit’ in 1921 (Knight 1921). Knight established the foundational differences between uncertainty and risks by pointing out that while, in the case of risks, the distribution of outcome in a group of instances is known, for uncertainties it is impossible to form a group of instances as the situation dealt with is unique to a high degree. He differentiated risk as ‘measurable uncertainty with objective probability’ and uncertainty as ‘immeasurable uncertainty with subjective probability’. However, this opinion is not embraced by all as some believe that many uncertainties are measurable, although some are not (McManus and Hastings 2005). Over the past nearly 100 years since Knight arguably established these classic distinctions between risk and uncertainty, these two sibling factors appear to have merged dangerously close to each other, with these terms even used interchangeably within the context of risk management (Perminova et al. 2008).

In 1961, Ellsberg added the concept of ambiguity within the specific context of establishing a subjective probability, by suggesting that the quality of information (amount, type, reliability, and unanimity) has a direct bearing on our confidence in the knowledge we utilize to establish subjective probabilities (Ellsberg 1961). Combining the works of Knight and Ellsberg, John Prpić summarized the key differences between risk and uncertainty, and defined risk as a situation where the probability and impact estimates of an event are objectively known, and the confidence in the quality of the information used to construct these estimates is very high. He further defined uncertainty as a situation where the probability and impact estimates of an event are subjectively determined, and the confidence in the quality of information used to construct these estimates varies from low to high (Prpić 2016). But as the ISO definition points out, the crucial determinant in identifying uncertainty is its potential to eventually lead to an effect on objectives, thereby causing a risk. However, this does not seem to be fully captured within Prpić’s definition. Moreover, Hillson points out that not all uncertainties are relevant within the context of risk management except the uncertainties that matter, which are those that, on occurrence of an event, will have either a positive or negative effect on objectives. The remaining uncertainties are irrelevant and do not need to be addressed under risk management (Hillson 2007).

Combining the knowledge base mentioned, the author proposes an inclusive definition of risk as a situation where the probability and impact estimates of an event are objectively known, the confidence in the quality of the information used to construct these estimates is high and where there is an estimated effect (positive or negative) of the event on objectives. The author further proposes that uncertainty be defined as a situation where the probability and impact estimates of an event are subjectively concluded; the confidence in the quality of information used to construct these estimates can vary from low to high, and has confirmed potential to become a risk only when its occurrence is estimated to have an effect (positive or negative) on objectives. These definitions highlight that not all uncertainties result in a risk, provide clarity on whether the probability and impact estimates were concluded objectively or subjectively, and also provides the confidence level in the quality of information used to construct these estimates. Due to these established differences between risk and uncertainty, there could be an opportunity for the introduction of uncertainty management capable of identifying and managing several sources of uncertainty which give rise to and shape our perceptions of threats and opportunities. Such a strategy would need an uncertainty identification process with a more open-ended, neutral description of factors, facilitating a less constrained consideration of response options (Ward and Chapman 2003).

The authors of an international perspective paper (Flage et al. 2014) report that measurement of uncertainty within risk assessment can be varied: subjective probability, non-probabilistic representations with interpretations as lower and upper probabilities, non-probabilistic representations with other representations such as degree of belief, degree of possibility, hybrid combinations of probabilistic and non-probabilistic representations and semi-quantitative approaches. They also suggest that where risk analysis of large uncertainties is conducted, probabilities may not reflect the knowledge or information available and recommend the need for an extended framework for risk assessment which reflects the separation that exists between the analyst and decision-maker. The choice of the method of measurement of uncertainty would be dependent on which risk theory each risk analyst adheres to. For example, adhering to the Theory of Statistical Decision of 1951, the analyst could treat all uncertainties as risks, evaluating them with a subjective probability measure (Savage 1951), whereas following the logical-relationist theory of Keynes, one would consider uncertainties as a state in which it is impossible to attribute a reasonably definite probability to the expected outcome (Nowotny et al. 2001).

While sensitivity evaluation experiments on the measurement of subjective probability seem to suggest that numeric measures outperform other scales (Haase et al. 2013), in some situations single-valued probability is not considered adequate to represent uncertainty, and non-probabilistic measures interpreted as lower and upper probabilities are seen as more appropriate (Flage et al. 2014). It has also been observed that certain uncertainties in scientific advice to policy-makers are not caused by probabilistic predictions, but could originate from a fundamental lack of understanding of new phenomena at or beyond the frontiers of present knowledge (May 2001). Concerning uncertainty management, apart from rational strategies (calculation of probabilities, weighing pros and cons etc.) and irrational strategies (faith, hope etc.), it has also been argued that the reality of human decision-making is influenced by ‘in-between strategies’ which may have some features of the rational (may rely on use of knowledge but not scientific knowledge) and features of the irrational (influence of personal context, feelings or beliefs); thus, including the use of trust, intuition, and emotion is vital (Zinn 2008).

The identification of risks is not always straightforward as they can be a borderless phenomenon, cutting across boundaries such as sociotechnical, geopolitical, organizational, cultural, physical, or health-related, across a range of tangible and intangible borders (Smith and Fischbacher 2009). The post-modern reality of the transcending of risks further into known uncertainty, unknown uncertainty (where one is missing information that others may possess), and even unknowable uncertainty (where others also lack information about the probability and thus perceived to be in the same boat) would require a more perceptive framework to address uncertainties at its evolving stages. The distinction between the unknown and unknowable uncertainty is said to depend on the assumption that a subject makes about the availability of information (Chow and Sarin 2002).

Prpić states, within the context of project risk management, that uncertainty should not be conceptualized as a dimension of risk but as a separate phenomenon that can and does occur simultaneously with risk, and that project risk management is in effect about the management of risk, uncertainty, and information confidence. He aptly suggests adding an information-confidence element to the subjective estimates of probability and impact to drive uncertainty management, and states that many such errors and omissions also exist in the ISO 31000 framework (Prpić 2016). The perception of uncertainty depends on personal skills, intuition, and judgement and though uncertainty cannot be eliminated, continuous reflective learning and information sharing can reduce it to manageable levels (Perminova et al. 2008). The explicit treatment and communication of uncertainty is stressed as critical to the credibility of risk assessments by the 1989 U.S National Research Council report which stated that risk messages and supporting materials should not minimize the existence of uncertainty and that data gaps and areas of significant disagreement among experts should be disclosed. It also recommended that some indication of the level of confidence of estimates and the significance of scientific uncertainty needs to be conveyed (National Research Council 1989). In the context of systems engineering, it should also be noted that while sensitivity analysis and uncertainty analysis are quite different, it is possible to carry out a sensitivity analysis of the model around a current solution and then use it as part of a first-order uncertainty analysis (Loucks and Van Beek 2017). Furthermore, it has been suggested that resilience engineering can also be relevant to uncertainty management where socio-technical systems are regarded as (self)-controlled systems, with a combination of open and closed control loops with the ability to react, to monitor, to anticipate and the ability to learn; the system must be able to expand its repertoire of responses based on its experience, but also to adapt its anticipatory strategies on the basis of the success or failure of past strategies (Pariès 2017).

2.2. Limitations and Deficiencies within the ISO 31000:2009 Framework

The benefits of the introduction of the ISO risk framework designed to be applicable to all industries has been lauded and supported by several risk management experts and commentators (Baker 2011; Dennis 2013; Gjerdrum and Peter 2011; Gjerdrum and Salen 2010; Neves et al. 2015; Purdy 2010). However, there has also been a steady flow of authors pointing out several components within the framework which they identify as possible deficiencies (Prpić 2016; Aven 2011; Lalonde and Boiral 2012). The absence of principles relating to the importance of a staff development program and establishing a system to acknowledge employees who detect risks early are pointed as limitations, and suggestions include the possible use of subjectivity, intuition, past experiences and motivation to enable efficient use of this standard (Lalonde and Boiral 2012). Even as ISO addresses risk as an “effect of uncertainty on objectives” a parallel addressing of risk as “an influence of scenarios to priorities” has been adopted by others (Barker et al. 2017; Thorisson et al. 2017).

2.3. Risk Perceptions and the Determinants of Risk-taking Behaviour

An organization’s risk attitude influences how its risks are assessed and addressed. They also influence whether or not risks are taken, tolerated, retained, shared, reduced, or avoided, and whether or not risk treatments are implemented or postponed (ISO 2009a). It is suggested that transformational leaders insist followers take risks to apply their creative ideas and notions, and that leaders themselves take risks on the basis of innovative solutions or ideas from followers, which in turn increases organizational risk-taking ability (Shafique and Kalyar 2018). In relation to the average layperson, risk perception is shaped by several largely unconscious emotional processes shared by scientists and nonscientists alike (Brown 2014). There are several factors which can influence the development of risk perception from childhood into adulthood. In a study involving 10–12 year olds, children were able to identify and relate to risks presented by linking it to their own personal experiences or an observation about others who were engaged in a similar activity like crossing at an intersection, using a sharp knife etc. (Bruce et al. 2009). Risk-taking behaviour is said to be influenced by characteristics of the person, the situation and whether affect is involved, and also the ‘who and when’ interact relating to the familiarity with a risk domain (Figner and Weber 2011). People with higher risk-perception as adults have a higher intention to engage in risk-reducing strategies, and a person who is more willing to take risks will have a lower subjective perception of risk. Empirically supported key determinants of risk-taking behaviour in children were identified as individual characteristics including age, sex, behavioural attributes, experience with activity, personal values and temperament, family/parent factors including socialization and teaching practices, parent modeling, style and attributes, sibling effects, socio-situational factors including persuasion influences, observational influences, and situation-driven motivations.

The literature review thus reinforces the perspective that the foundational differences between the concepts of risk and uncertainty may not be fully appreciated within the ISO 31000 model. Also, there appears to be a valid case for the introduction of a dedicated uncertainty management component within the risk management framework, and where numerical probabilities are not appropriate as an uncertainty measure, non-probabilistic measures with upper and lower probabilities may be necessary. Information sharing is identified as the key to manage uncertainties and credibility given to the suggestion that ‘information confidence’ may need to be added to the subjective estimates of probability and impact concerning uncertainty management. Deficiencies within the ISO framework have been identified from various quarters, with the further need for non-management employees to be involved in the risk process for early detection of risks and further risk-related training programs. Furthermore, risk-perception is said to be directly impacted by risk attitudes and the key determinants of risk-taking behaviour have been identified from social developmental research. These factors would have immense potential to be harnessed together to create a potent tool for uncertainty identification.

3. The Theory of Risk-Sentience (ToRS)

Sentience is a term which appears to have no universally accepted definition (Proctor et al. 2013), with some defining a ‘sentient being’ as someone who has the ability to evaluate the action of others in relation to itself or third parties, to remember its own actions and consequences, to assess risks and benefits, to possess a degree of feelings and awareness (Broom 2014). The term ‘sentience’ is generally considered as the ability to feel, perceive, or experience subjectively. The author introduces a new risk terminology referred to as ‘risk-sentience’ defined as the elementary and innate ability to initially perceive, feel or experience subjectively the future potential of an event for positive or negative deviation from objectives, arising from uncertainties, intuitions, past experiences or interoceptive sensations. The key relevance of utilising interoceptive abilities, intuitions, and other emotional responses (Kandasamy et al. 2016; Bechara and Damasio 2005; Lo and Repin 2002) in risk-decision making within financial trading has been well documented.

The Theory of Risk-Sentience proposes that while risk perception is the subjective judgement that people make about the characteristics and severity of a risk, risk-sentience refers to the more primal and rudimentary feeling limited to merely sensing possibility of an uncertainty to develop into the status of a future risk. It is thus proposed that risk-sentience is the innate precursor of risk perception. There are innumerable examples of uncertainties in medicine where components of risk-sentience are relied upon by physicians every day in ordering additional tests or having difficulty in interpreting a mammogram while picking out the shadows that signify cancer from a mass of similar shadows. Dr. Steven Hatch explains that uncertainty lies at the heart of what physicians do on a daily basis with an example. An elderly woman is in the ICU, and doctors on rounds are discussing her case and debating how to proceed. Her daughter asks, “So, you don’t know why she’s sick?” The doctor says he isn’t sure. “Do you think she should get a CAT scan?” He says he’s not sure; it would help pin down a diagnosis, but there is a risk that the contrast material might damage her ailing kidneys, perhaps irreversibly. “Do you think she needs antibiotics?” “Yes, I’m pretty sure, at least until we have another explanation that would indicate we can safely stop them.” The diagnosis of uncertainty in the context of a physician-patient relationship has been suggested to be a relational act with each assuming differing responsibilities to exchange information. This is done towards achieving a shared consciousness of uncertainty which has been referred to as a ‘shared mind’ for managing the uncertainties of treatment (Epstein and Peters 2009). While information-sharing has alone been proven to be effective in decision-making for uncertainty management interventions in healthcare (Nelson et al. 2007), in the context of irreducible uncertainty, where there is no known knowledge gap, the capacity for such uncertainty to be seen as a source of possibility or hope should not be dismissed (Babrow and Kline 2000). While risk-sentience is an inborn skill, it is theorized that it can be artificially harnessed and heightened by a continual process involving sharing of uncertainties, other’s mistakes, experiences (personal and others), and anecdotal reporting of related information. It is also proposed that safety or risk-culture will not be easy to cultivate in an organization until its precursor risk-sentience, being a natural and innate skill, is well-watered and nurtured primarily.

While uncertainty has been defined as the state, even partial, of deficiency of information related to understanding or knowledge of an event, its consequence, or likelihood, risk is defined as the effect of uncertainty on objectives (ISO 2009b). The effect referred to is a deviation from the expected—positive and/or negative. A cumulative analysis would thus infer risk is a result arising only in the situation where there exists a deficiency of information related to understanding or knowledge of an event, its consequence, or likelihood which causes a positive or negative deviation from an objective. However, there appears to be a missing component, as there also is in existence emerging risk-information which may not have identifiable deficiency in reference to the currently available knowledge pool, and the likelihood that its own effect could cause a positive or negative deviation from an objective may be within the realms of reasonable certainty. In the ISO Guide-73, a risk source is defined as an element which alone or in combination has the intrinsic potential to give rise to risk (ISO 2009a). The Theory of Risk-Sentience also suggests that uncertainty is not the sole potential owner to be a risk source as the ISO definition suggests, but can be so when combined with all risk-sentience information. The term ‘risk-sentience information’ is defined by the author as all relevant emerging risk-information which may or may not have identifiable deficiency with reference to all available body of knowledge, and its likelihood that its effect will cause a positive or negative deviation from an objective includes a reasonable certainty, with the source of such information originating from uncertainties, intuitions, past experiences or interoceptive sensations. Risk-sentience information management can be defined as a heuristic method of management of all risk-sentience information, including uncertainties, with the core objective of preventing them from attaining the state of an identifiable risk in the future. The Theory of Risk-Sentience initially overlaps certain characteristics of a safety/risk culture within an organization, but then demarcates itself completely by going much further in its demand for developing an organizational consciousness which is able to pro-actively seek out and address many uncertainties or evolving risk-sentience information through an ongoing, interactive, and robust process.

4. The Risk-Sentience Auxiliary Framework (RSAF)

The Risk-Sentience Auxiliary Framework (RSAF) is proposed as a supplementary enterprise risk management framework to the ISO 31000, designed specifically for environments characterized by high risk with components of volatility, uncertainty, complexity, and ambiguity (VUCA). It incorporates aspects of management of both risk-sentience information and uncertainties with the core objective of containing or slowing them from attaining the state of an identifiable risk in the future. The RSAF framework developed (Figure 1) was specifically designed to serve as an auxiliary component to further supplement the efficiency of the current ISO framework, and not to undo or make impotent any of the components which constitute the organization’s active risk management framework. The components identified for inclusion were non-management employee commitment and pro-active engagement; appropriate risk attitude and behavior; continual risk-sentience development and strategy; transparent, anonymous, and timely recording of risk-sentience data; and a blame-free culture towards bad news and mistakes. Personal values and ethics were assigned the central position within the framework, to convey their influence as a key driver of the framework.The framework was designed as a planetary cog-wheel system with high personal values and ethics as the sun and also conveys the interdependency of each of the risk-sentience components towards powering the ISO 31000 framework.

The author aimed to design and develop a new risk-sentience management process aligned at least 80% to key domains of empirically supported determinants of children’s risk decisions. Three core domains of empirically supported determinants of development of risk awareness were identified as individual characteristics, family/parent factors, and social-situational factors (Morrongiello and Lasenby-Lessard 2007). The new process designed was named as LUOMEAR (Figure 2) and consisted of the following components: learning from uncertainties, others’ mistakes, experiences, and anecdotal reporting. As demonstrated (

Table 1. Integration of risk-determinants into LUOMEAR (Learning from Uncertainties, Others Mistakes, Experiences and Anecdotal Reporting).

Determinant Factors	Points	LUOMEAR Process	Points
	Individual characteristics	Learning from…
Age	1	Personal Experiences	1
Sex	1	Personal Experiences	1
Behavioural attributes	1	--------------------	0
Experience with activity	1	Personal experience	1
Personal experience & Values Temperament	1 1	Values & ethics --------------------	1 0
	Family/parent factors
Socialization practices	1	Others mistakes	1
Teaching practices	1	+	1
Parent modelling	1	Personal experiences	1
Parenting style	1	+	1
Parenting attributes Sibling effects Oral-persuasion influences Observational influences Situational motivations	1 1 Social-situational factors 1 1 1	Anecdotal reporting Anecdotal reporting Personal experiences Personal experiences	1 0 1 1 1
Total	15 (100%)	Total	12 (80%)

), 80% of the risk determinant components were successfully integrated into the LUOMEAR process.

The author also aimed to develop a Risk-Sentience Fertility (RSF) Checklist incorporating key indicators of healthy risk culture. Four key indicators were identified as tone at the top, governance, competency, and decision-making (Institute of Risk Management 2012). Eleven of the eighteen statements forming the newly developed Risk-Sentience Fertility Checklist were aligned to the components of the IRM (Institute of Risk Management) Risk Culture model (Table 2).This checklist (Table 3) was developed to serve as a health indicator of the risk-sentience culture within an enterprise.

Table 2. Integration of key IRM (Institute of Risk Management) Risk Culture indicators into the Risk-Sentience Fertility Checklist.

IRM Risk Culture	Points	Risk-Sentience Checklist	Points
	Tone at the Top
Risk leadership-Clarity of direction	1	Statement-2	1
Organisation response to bad news	1	Statement-3,6,7	1
	Governance
Clarity of accountability for managing risk	1	Statement-9	1
Transparency and timeliness of risk information	1	Statement-6,7	1
	Competency
Status, resources, and empowerment of risk function	1	Statement-4,17	1
Embedding of risk management skills	1	Statement-1,12,15	1
	Decision making
Well informed risk decisions	1	Statement-11,12,13,14	1
Appropriate risk taking rewarded	1	Statement-5	1
Total	8	Total	8

Table 2. Integration of key IRM (Institute of Risk Management) Risk Culture indicators into the Risk-Sentience Fertility Checklist.

IRM Risk Culture	Points	Risk-Sentience Checklist	Points
	Tone at the Top
Risk leadership-Clarity of direction	1	Statement-2	1
Organisation response to bad news	1	Statement-3,6,7	1
	Governance
Clarity of accountability for managing risk	1	Statement-9	1
Transparency and timeliness of risk information	1	Statement-6,7	1
	Competency
Status, resources, and empowerment of risk function	1	Statement-4,17	1
Embedding of risk management skills	1	Statement-1,12,15	1
	Decision making
Well informed risk decisions	1	Statement-11,12,13,14	1
Appropriate risk taking rewarded	1	Statement-5	1
Total	8	Total	8

Table 3. Risk-Sentience Fertility (RSF) Checklist.

Statement	Yes	?	No
(1) Risk Management is clearly recognized within the entire organization as a shared responsibility of each and every employee, and not just that of the senior/risk management team.
(2) The organization has the leadership and openness to acknowledge its failures, to apologize for them, and to reassure that the lessons learned from past errors will help prevent their recurrence.
(3) After an adverse event, the senior management attempts to learn from it rather than try to attribute blame on the person reporting it.
(4) Employees from a wide variety of departments and levels regularly attend meetings related to risk management.
(5) Appropriate and prudent risk-taking behaviours are rewarded and encouraged, and inappropriate behaviours challenged and receive a sanction.
(6) There is a very transparent risk-information flow within the organization with bad news rapidly communicated without any fear of blame.
(7) The organization always encourages anyone to raise safety concerns and risk issues. Messengers and whistleblowers are encouraged and rewarded, not dismissed or discredited.
(8) The organization relies on building trust and transparency with its workforce, with the full realization that a robust risk management reporting system will not survive without it.
(9) Accountability-Each employee within the organization is fully aware of the risks for which they take full ownership and how to escalate risks which they have identified.
(10) Effective challenge-Alternate views, opinions, and debates on current risk management systems and their effectiveness are encouraged and facilitated in an ongoing manner.
(11) A secure organizational database is present with a collection of all identified risks (e.g., Risk Register), with full access to all staff members, and is continuously updated.
(12) Access to evolving risk-information: All employees are given full access to anonymously add evolving risk-related information into the database without any fear of repercussions or blame.
(13) Experiences: Relevant personal experiences which have potential to evolve into risks have a dedicated system/process to be shared, discussed, and addressed to prevent/contain them developing into identified risks.
(14) Anecdotal Reporting: Third-party reporting of evolving risk-information has a dedicated system/process to be shared, discussed, and addressed to prevent/contain them developing into identified risks.
(15) There is a robust, separate, and ongoing non-management powered risk management process, which blends in without conflict to the senior management-driven mandate towards effective risk management.
(16) Risk management is seen widely in the organization, not as a top-down approach but rather as a side-side approach with every employee equally valued and involved in this process.
(17) Risk management has a feeling of genuine ownership by most of the non-management employees.
(18) High personal values and ethics are seen as the core drivers of an organizational risk management framework.

Yes = This is definitely the case in my organization (score = 1); ? = Don’t know, Maybe, or could be partially true (score = 0.5); No = This is definitely not the case in my organization (score = 0).

Table 3. Risk-Sentience Fertility (RSF) Checklist.

Statement	Yes	?	No
(1) Risk Management is clearly recognized within the entire organization as a shared responsibility of each and every employee, and not just that of the senior/risk management team.
(2) The organization has the leadership and openness to acknowledge its failures, to apologize for them, and to reassure that the lessons learned from past errors will help prevent their recurrence.
(3) After an adverse event, the senior management attempts to learn from it rather than try to attribute blame on the person reporting it.
(4) Employees from a wide variety of departments and levels regularly attend meetings related to risk management.
(5) Appropriate and prudent risk-taking behaviours are rewarded and encouraged, and inappropriate behaviours challenged and receive a sanction.
(6) There is a very transparent risk-information flow within the organization with bad news rapidly communicated without any fear of blame.
(7) The organization always encourages anyone to raise safety concerns and risk issues. Messengers and whistleblowers are encouraged and rewarded, not dismissed or discredited.
(8) The organization relies on building trust and transparency with its workforce, with the full realization that a robust risk management reporting system will not survive without it.
(9) Accountability-Each employee within the organization is fully aware of the risks for which they take full ownership and how to escalate risks which they have identified.
(10) Effective challenge-Alternate views, opinions, and debates on current risk management systems and their effectiveness are encouraged and facilitated in an ongoing manner.
(11) A secure organizational database is present with a collection of all identified risks (e.g., Risk Register), with full access to all staff members, and is continuously updated.
(12) Access to evolving risk-information: All employees are given full access to anonymously add evolving risk-related information into the database without any fear of repercussions or blame.
(13) Experiences: Relevant personal experiences which have potential to evolve into risks have a dedicated system/process to be shared, discussed, and addressed to prevent/contain them developing into identified risks.
(14) Anecdotal Reporting: Third-party reporting of evolving risk-information has a dedicated system/process to be shared, discussed, and addressed to prevent/contain them developing into identified risks.
(15) There is a robust, separate, and ongoing non-management powered risk management process, which blends in without conflict to the senior management-driven mandate towards effective risk management.
(16) Risk management is seen widely in the organization, not as a top-down approach but rather as a side-side approach with every employee equally valued and involved in this process.
(17) Risk management has a feeling of genuine ownership by most of the non-management employees.
(18) High personal values and ethics are seen as the core drivers of an organizational risk management framework.

Yes = This is definitely the case in my organization (score = 1); ? = Don’t know, Maybe, or could be partially true (score = 0.5); No = This is definitely not the case in my organization (score = 0).

Interpreting your score on risk—sentience fertility checklist

16–18	Excellent, but keep the learning on!
1–15	Good, but don’t get complacent
6–10	Developing, but needs more focus and planning
0–5	Primitive level, needs major policy changes.

Guidance Notes: [Being a checklist, the scores are only indicators of what is working well and areas to develop on. The results are merely meant to be a focus-point to generate meaningful debate and discussion in improving the Risk-Sentience culture within an organization].

Interpreting your score on risk—sentience fertility checklist

16–18	Excellent, but keep the learning on!
1–15	Good, but don’t get complacent
6–10	Developing, but needs more focus and planning
0–5	Primitive level, needs major policy changes.

Guidance Notes: [Being a checklist, the scores are only indicators of what is working well and areas to develop on. The results are merely meant to be a focus-point to generate meaningful debate and discussion in improving the Risk-Sentience culture within an organization].

5. Ethical Approval and LUOMEAR Process Implementation

The participant pool was limited to the community occupational therapy staff, excluding the department manager and the author. Royal College of Surgeons in Ireland (RCSI) Ethics Committee approval was received covering the entire scope of this study and data collection (RCSI Reference Number: REC 1162). Among the staff members invited to participate in the study, five senior occupational therapists volunteered to participate in the study and were required to participate in four different processes:

1)

Pre-trial evaluation: Consisting of the Manchester Patient Safety Assessment Framework (MaPSaF) (National Patient Safety Agency 2006), SWOT analysis and Risk-Sentience Fertility Checklist with a total time commitment of an hour.

2)

LUOMEAR process (Figure 2): The participants were also given the opportunity to trial the LUOMEAR computer program (Figure 3) which ran for a period of three months. The records created by the participants were categorized under: (a) Uncertainties; (b) Others Mistakes; (c) Experiences; (d) Anecdotal Reporting. Under each of the above classification they were able to add information under (1) Category (e.g., Identify as mistake/experience etc.); (2) Brief description; (3) Potential to develop into future risk, as low/medium/high; (4) Suggested solution/how to address it. Electronic data collection by participants within LUOMEAR computer program occurred on an ongoing basis only during office hours and accessed through a secure shared drive.

The author customized the LUOMEAR repository computer program using free tree-based database software available on the internet. At the end of the trial period, a total of 14 separate records were created by the participants.

3)

Action learning Sets: Two half-hour Action Learning Set (ALS) meetings were held during each monthly staff peer-support meeting. In each peer-support meeting within the 3-month period, the ALS session included a participant reading out anonymously submitted risk-sentience information. The ALS group members, who included both participants and non-participants, subjectively rated their confidence in the quality of the information recorded and assigned a rating of low, medium and high potential to evolve into a future identifiable risk through collective agreement. A recommended action was formulated by the group and forwarded to the department manager for final decision and action, as required; otherwise, the learning from the records was disseminated within the group.

4)

Post-trial evaluation: Consisted of the Manchester Patient Safety Assessment Framework (MaPSaF), SWOT analysis and Risk-Sentience Fertility Checklist with a time commitment of an hour.

The project had been deliberately designed to limit identification of participants and ensured collection of anonymous electronic and hand-written data, with identifiable components limited as much as reasonably possible. The total time commitment required from each participant was approximately three hours over a period of five months, excluding the individual time involved in their separate submissions in the computer program while creating anonymous records. After the pilot implementation and evaluations, the author liaised with the department manager and discussed the improvements evidenced through the collected data. It was agreed that the actions recommended by the ALS sessions relating to the records created through the LUOMEAR process would be addressed through formal procedures as appropriate.

6. Evaluation

The system evaluation involved pre and post-trial completion of three tools: the MaPSaF (Table 4), SWOT analysis, and the Risk-Sentience Checklist (Table 5). Risk-sentience information was recorded from all the available categories of LUOMEAR as follows: one record relating to policies and protocols in the category of Uncertainty, two records relating to pressure ulcer prevention and prescription of aids/appliances recorded under the category of Mistakes, seven records relating to hoist assessment and prescription, wheelchairs, pressure ulcers and aids/appliances recorded under the category of Experiences and four records relating to pressure ulcers, aids/appliances, hoist assessment/prescription, and manual handling recorded under the category of Anecdotal reporting. Action was either initiated or completed for twelve of the fourteen risk-sentience information records created within the LUOMEAR process, thus containing their potential for developing further into an identifiable risk. The potential for two of the risk-sentience information records to develop into an identifiable risk in the future was assessed as within acceptable levels, and action was confirmed as unnecessary by the department manager. A significant and direct outcome of the trial was the development and implementation of a new departmental policy relating to the half-yearly review of potentially high-risk medical equipment.

Table 4. MaPSaF Data Compilation. MANCHESTER PATIENT SAFETY FRAMEWORK (MAPSAF)—PRIMARY CARE EVALUATION DATA COMPILATION.

1. Commitment to quality	A	B	C	D	E
Pre-trial (Team)	2	0	1	1	1
Post-trial (Team)	0	1	1	2	1
Pre-trial (Organisation)	0	1	3	1	0
Post-trial (Organisation)	0	2	2	1	0
2. Priority to patient safety	A	B	C	D	E
Pre-trial (Team)	0	0	2	1.5	1.5
Post-trial (Team)	0	1	0	2	2
Pre-trial (Organisation)	0	1	2	1.5	0.5
Post-trial (Organisation)	0	2	1	0	2
3. Perception to causes of patient Safety Incidents & their identification	A	B	C	D	E
Pre-trial (Team)	0	0	4	1	0
Post-trial (Team)	0	0	1	4	0
Pre-trial (Organisation)	0	0	4	1	0
Post-trial (Organisation)	0	0	2	3	0
4. Investigating patient safety incidents	A	B	C	D	E
Pre-trial (Team)	0	0	2	2.5	0.5
Post-trial (Team)	0	1	0	4	0
Pre-trial (Organisation)	0	0	4	0.5	0.5
Post-trial (Organisation)	0	0	2	3	0
5. Organisational learning following a patient safety incident	A	B	C	D	E
Pre-trial (Team)	0	0	3.5	1.5	0
Post-trial (Team)	0	0	3	1	1
Pre-trial (Organisation)	0	0	4.5	0.5	0
Post-trial (Organisation)	0	0	2	3	0
6. Communication about safety issues	A	B	C	D	E
Pre-trial (Team)	0	0.5	3.5	1	0
Post-trial (Team)	0	0	2	2	1
Pre-trial (Organisation)	0	1.5	3.5	0	0
Post-trial (Organisation)	0	1	3	1	0
7. Personnel management & Safety issues	A	B	C	D	E
Pre-trial (Team) *	0	0	3	1	0
Post-trial (Team)	0	0	2	3	0
Pre-trial (Organisation)	0.5	0.5	2	2	0
Post-trial (Organisation)	0	1	0	3	1
8. Staff education and training about safety issues	A	B	C	D	E
Pre-trial (Team) *	0	0	2	1	1
Post-trial (Team)	0	1	2	2	0
Pre-trial (Organisation)	0	0	3	2	0
Post-trial (Organisation)	0	0	4	1	0
9. Team working around Safety issues	A	B	C	D	E
Pre-trial (Team)	0	2.5	1.5	1	0
Post-trial (Team)	0	1	1	2	1
Pre-trial (Organisation)	0	1	3	1	0
Post-trial (Organisation)	0	1	2	2	0

* One participant did not apply a rating for team patient safety culture in this evaluation by error.

Table 4. MaPSaF Data Compilation. MANCHESTER PATIENT SAFETY FRAMEWORK (MAPSAF)—PRIMARY CARE EVALUATION DATA COMPILATION.

1. Commitment to quality	A	B	C	D	E
Pre-trial (Team)	2	0	1	1	1
Post-trial (Team)	0	1	1	2	1
Pre-trial (Organisation)	0	1	3	1	0
Post-trial (Organisation)	0	2	2	1	0
2. Priority to patient safety	A	B	C	D	E
Pre-trial (Team)	0	0	2	1.5	1.5
Post-trial (Team)	0	1	0	2	2
Pre-trial (Organisation)	0	1	2	1.5	0.5
Post-trial (Organisation)	0	2	1	0	2
3. Perception to causes of patient Safety Incidents & their identification	A	B	C	D	E
Pre-trial (Team)	0	0	4	1	0
Post-trial (Team)	0	0	1	4	0
Pre-trial (Organisation)	0	0	4	1	0
Post-trial (Organisation)	0	0	2	3	0
4. Investigating patient safety incidents	A	B	C	D	E
Pre-trial (Team)	0	0	2	2.5	0.5
Post-trial (Team)	0	1	0	4	0
Pre-trial (Organisation)	0	0	4	0.5	0.5
Post-trial (Organisation)	0	0	2	3	0
5. Organisational learning following a patient safety incident	A	B	C	D	E
Pre-trial (Team)	0	0	3.5	1.5	0
Post-trial (Team)	0	0	3	1	1
Pre-trial (Organisation)	0	0	4.5	0.5	0
Post-trial (Organisation)	0	0	2	3	0
6. Communication about safety issues	A	B	C	D	E
Pre-trial (Team)	0	0.5	3.5	1	0
Post-trial (Team)	0	0	2	2	1
Pre-trial (Organisation)	0	1.5	3.5	0	0
Post-trial (Organisation)	0	1	3	1	0
7. Personnel management & Safety issues	A	B	C	D	E
Pre-trial (Team) *	0	0	3	1	0
Post-trial (Team)	0	0	2	3	0
Pre-trial (Organisation)	0.5	0.5	2	2	0
Post-trial (Organisation)	0	1	0	3	1
8. Staff education and training about safety issues	A	B	C	D	E
Pre-trial (Team) *	0	0	2	1	1
Post-trial (Team)	0	1	2	2	0
Pre-trial (Organisation)	0	0	3	2	0
Post-trial (Organisation)	0	0	4	1	0
9. Team working around Safety issues	A	B	C	D	E
Pre-trial (Team)	0	2.5	1.5	1	0
Post-trial (Team)	0	1	1	2	1
Pre-trial (Organisation)	0	1	3	1	0
Post-trial (Organisation)	0	1	2	2	0

* One participant did not apply a rating for team patient safety culture in this evaluation by error.

Table 5. Risk-Sentience Checklist—Collected Data.

Statement		Yes	?	No
(1) Risk Management is clearly recognized within the entire organization as a shared responsibility of each and every employee, and not just that of the senior/risk management team.	Pre-trial	2	2	1
	Posttrial	5	0	0
(2) The organization has the leadership and openness to acknowledge its failures, to apologize for them, and to reassure that the lessons learned from past errors will help prevent their recurrence.	Pre-trial	1	3	1
	Post trial	2	3	0
(3) After an adverse event, the senior management attempts to learn from it rather than try to attribute blame on the person reporting it.	Pre-trial	2	2	1
	Post trial	3	2	0
(4) Employees from a wide variety of departments and levels regularly attend meetings related to risk management.	Pre-trial	0	2	3
	Post trial	1	3	1
(5 Appropriate and prudent risk-taking behaviours are rewarded and encouraged, and inappropriate behaviours challenged and receive a sanction.	Pre-trial	0	4	1
	Post trial	3	2	0
(6) There is a very transparent risk-information flow within the organization with bad news rapidly communicated without any fear of blame.	Pre-trial	2	3	0
	Post trial	2	1	2
(7) The organization always encourages anyone to raise safety concerns and risk issues. Messengers and whistleblowers are encouraged and rewarded, not dismissed or discredited.	Pre-trial	2	3	0
	Post trial	3	1	1
(8) The organization relies on building trust and transparency with its workforce, with the full realization that a robust risk management reporting system will not survive without it.	Pre-trial	1	4	0
	Post trial	3	2	0
(9) Accountability-Each employee within the organization is fully aware of the risks for which they take full ownership and how to escalate risks which they have identified.	Pre-trial	2	3	0
	Post trial	2	2	1
(10) Effective challenge-Alternate views, opinions, and debates on current risk management systems and their effectiveness are encouraged and facilitated in an ongoing manner.	Pre-trial	0	2	3
	Post trial	1	3	1
(11) A secure organizational database is present with a collection of all identified risks (e.g., Risk Register), with full access to all staff members and is continuously updated.	Pre-trial	1	3	1
	Post trial	3	2	0
(12) Access to evolving risk-information: All employees are given full access to anonymously add evolving risk-related information into the database without any fear of repercussions or blame.	Pre-trial	0	1	4
	Post trial	3	2	0
(13) Experiences: Relevant personal experiences which have potential to evolve into risks have a dedicated system/process to be shared, discussed, and addressed to prevent/contain them developing into identified risks.	Pre-trial	0	4	1
	Post trial	3	2	0
(14) Anecdotal Reporting: Third-party reporting of evolving risk-information has a dedicated system/process to be shared, discussed, and addressed to prevent/contain them developing into identified risks.	Pre-trial	0	2	3
	Post trial	3	2	0
(15) There is a robust, separate, and ongoing non-management powered risk management process, which blends in without conflict to the senior management-driven mandate towards effective risk management.	Pre-trial	0	3	2
	Post trial	1	3	1
(16) Risk management is seen widely in the organization, not as a top-down approach but rather as a side-side approach with every employee equally valued and involved in this process.	Pre-trial	0	1	4
	Post trial	0	4	1
(17) Risk management has a feeling of genuine ownership by most of the non-management employees.	Pre-trial	1	3	1
	Post trial	0	5	0
(18) High personal values and ethics are seen as the core drivers of an organizational risk management framework.	Pre-trial	1	3	1
	Post trial	0	5	0

Interpreting your score on the Risk—Sentience Fertility Checklist; Yes = This is definitely the case in my organization (score = 1); ? = Don’t know, Maybe, or could be partially true (score = 0.5); No = This is definitely not the case in my organization (score = 0).

Table 5. Risk-Sentience Checklist—Collected Data.

Statement		Yes	?	No
(1) Risk Management is clearly recognized within the entire organization as a shared responsibility of each and every employee, and not just that of the senior/risk management team.	Pre-trial	2	2	1
	Posttrial	5	0	0
(2) The organization has the leadership and openness to acknowledge its failures, to apologize for them, and to reassure that the lessons learned from past errors will help prevent their recurrence.	Pre-trial	1	3	1
	Post trial	2	3	0
(3) After an adverse event, the senior management attempts to learn from it rather than try to attribute blame on the person reporting it.	Pre-trial	2	2	1
	Post trial	3	2	0
(4) Employees from a wide variety of departments and levels regularly attend meetings related to risk management.	Pre-trial	0	2	3
	Post trial	1	3	1
(5 Appropriate and prudent risk-taking behaviours are rewarded and encouraged, and inappropriate behaviours challenged and receive a sanction.	Pre-trial	0	4	1
	Post trial	3	2	0
(6) There is a very transparent risk-information flow within the organization with bad news rapidly communicated without any fear of blame.	Pre-trial	2	3	0
	Post trial	2	1	2
(7) The organization always encourages anyone to raise safety concerns and risk issues. Messengers and whistleblowers are encouraged and rewarded, not dismissed or discredited.	Pre-trial	2	3	0
	Post trial	3	1	1
(8) The organization relies on building trust and transparency with its workforce, with the full realization that a robust risk management reporting system will not survive without it.	Pre-trial	1	4	0
	Post trial	3	2	0
(9) Accountability-Each employee within the organization is fully aware of the risks for which they take full ownership and how to escalate risks which they have identified.	Pre-trial	2	3	0
	Post trial	2	2	1
(10) Effective challenge-Alternate views, opinions, and debates on current risk management systems and their effectiveness are encouraged and facilitated in an ongoing manner.	Pre-trial	0	2	3
	Post trial	1	3	1
(11) A secure organizational database is present with a collection of all identified risks (e.g., Risk Register), with full access to all staff members and is continuously updated.	Pre-trial	1	3	1
	Post trial	3	2	0
(12) Access to evolving risk-information: All employees are given full access to anonymously add evolving risk-related information into the database without any fear of repercussions or blame.	Pre-trial	0	1	4
	Post trial	3	2	0
(13) Experiences: Relevant personal experiences which have potential to evolve into risks have a dedicated system/process to be shared, discussed, and addressed to prevent/contain them developing into identified risks.	Pre-trial	0	4	1
	Post trial	3	2	0
(14) Anecdotal Reporting: Third-party reporting of evolving risk-information has a dedicated system/process to be shared, discussed, and addressed to prevent/contain them developing into identified risks.	Pre-trial	0	2	3
	Post trial	3	2	0
(15) There is a robust, separate, and ongoing non-management powered risk management process, which blends in without conflict to the senior management-driven mandate towards effective risk management.	Pre-trial	0	3	2
	Post trial	1	3	1
(16) Risk management is seen widely in the organization, not as a top-down approach but rather as a side-side approach with every employee equally valued and involved in this process.	Pre-trial	0	1	4
	Post trial	0	4	1
(17) Risk management has a feeling of genuine ownership by most of the non-management employees.	Pre-trial	1	3	1
	Post trial	0	5	0
(18) High personal values and ethics are seen as the core drivers of an organizational risk management framework.	Pre-trial	1	3	1
	Post trial	0	5	0

Interpreting your score on the Risk—Sentience Fertility Checklist; Yes = This is definitely the case in my organization (score = 1); ? = Don’t know, Maybe, or could be partially true (score = 0.5); No = This is definitely not the case in my organization (score = 0).

16–18	Excellent, but keep the learning on!
11–15	Good, but don’t get complacent
6–10	Developing, but needs more focus and planning
0–5	Primitive level, needs major policy changes.

[Guidance notes: Being a checklist, the scores are only indicators of what is working well and areas to develop on. The results are merely meant to be a focus-point to generate meaningful debate and discussion in improving the Risk-sentience culture within an organization].

16–18	Excellent, but keep the learning on!
11–15	Good, but don’t get complacent
6–10	Developing, but needs more focus and planning
0–5	Primitive level, needs major policy changes.

[Guidance notes: Being a checklist, the scores are only indicators of what is working well and areas to develop on. The results are merely meant to be a focus-point to generate meaningful debate and discussion in improving the Risk-sentience culture within an organization].

Pre-trial evaluation

Total scores from each participant—9, 5.5, 9, 7.5, 8

Mean score= 7.8/18

Interpreting the scores:

6–10	Developing, but needs more focus and planning

Post-trial evaluation

Total scores from each participant—12, 13, 12, 12.5, 10.5

Mean score= 12/18

Interpreting the scores:

11–15

Good, but don’t get complacent

7. Discussion

The Manchester Patient Safety framework (MaPSaF) data analysis recorded positive variances in the safety culture components of commitment to quality, communication about safety issues, and team working around safety issues with progress into the pro-active and generative safety culture levels (Figure 4, Figure 5 and Figure 6). It is to be noted that some participants chose to assign the T (Team) score across two culture components and in a few cases did not assign a score. Considering the 3-month implementation of this pilot trial, this positive, yet modest shift is notable. Due to participant error during the pre-trial evaluation, the rating of personnel management and safety issues, and staff education and training about safety issues could not be analyzed.

The post-trial SWOT analysis revealed the benefit themes realized by the participants in employing the RSAF framework and process were blame-free learning, a positive learning experience, and ease of use. The weakness themes were identified as too much data, concerns on the security of data collected, and subjectivity of information with potential for misinterpretation of results. The themes under opportunities were identified as the possible potential to develop the framework and process further, the potential to be a game-changer for future risk management, and its adaptability for multi-disciplinary team use. The possible threat themes were identified as poor buy-in from staff, increased work-load, and the possibility that some managers may not be open to receiving feedback.

The Risk-Sentience Fertility Checklist data analysis recorded improvements in risk management seen as a shared responsibility, building trust and transparency, accessing evolving risk-information, personal experiences/anecdotal reporting having a dedicated process to be shared and addressed, and in robust non-management powered risk-management process. Subtle improvements were recorded post-trial in risk-management being perceived as a side-side approach rather than top-down approach, genuine feeling of ownership of risk management experienced by non-management employees, and with personal values and ethics being perceived as drivers of the risk management framework. While the newly developed checklist was designed merely as an indicator of the current risk-sentience culture within a specific organization, it would also be beneficial in facilitating thought and discussions on possible areas of improvement. The improvements recorded by the participants highlight opportunities presented to high-risk environments in the area of risk-sentience information and uncertainty management.

8. Potential Applications of the RSAF Framework

While efficient systemic approaches exist to evaluate large-scale risk program maturity utilizing business process modeling (Teng et al. 2012a), it is important that organizations at the outset seriously consider three crucial questions to ascertain the mission of their planned risk program: what sources of risks are to be managed by the program; how multiple risk assessments, risk management, and risk communication activities are to be administered and coordinated and the basis for resource allocation to these activities; and how the performance of the program is to be monitored and evaluated (Teng et al. 2012b). Only at this healthy stage of risk strategy development, the scope of applying the risk-sentience management framework and process to contain evolving risk-information should be considered by the organization.

The key strength of the RSAF and process at preliminary examination appears to be its concentrated ability to impact on the safety culture of the staff members within the shortest possible timeframes. Also, the ease of flow of risk-sentience information propelled by the anonymous component of the process appeared to encourage a more open willingness to share information without fear of blame or gossip. In the financial institutions sector, the LUOMEAR process sections under the main categories of Uncertainties, Others Mistakes, Experiences, and Anecdotal Reporting could include credit, liquidity, interest rate, operational including mistakes and fraud committed by staff members, technology including those relating to power and equipment failures leading to data loss, product innovation, regulation, and competition. In the education sector, the sections could include political interference, patronage networks, weak sector institutions, inefficient systems, governance, accountability, and resource management. In the oil and gas sector, the sections could include political, geological, price, supply and demand, and cost. In the insurance sector, the sections could relate to cost of capital and availability, tax and accounting changes, corporate governance, regulation, talent recruiting skills, data security, reputational risk, macroeconomic trends, eurozone debt crisis, and operational issues. In the retail sector, the sections could relate to consumer trends, regulation, general economic conditions, credit markets and availability of finances, labour, legal proceedings, and competition and consolidation. In the energy sector, the sections could be compliance and regulation, climate policy and carbon pricing, commodity price volatility, managing planning and public acceptance of risks, talent, renewable subsidies, low-carbon technologies, economic shocks, political intervention, and accessibility of capital. Another crucial application could be to guide the research and development for energy systems (e.g., smart and secure microgrids for industrial and military installations and solar cogeneration technologies) where deep uncertainties and emergent conditions are said to exist (Hamilton et al. 2012). The applicability potential thus of the ToRS, the RSAF, and the LUOMEAR within high-risk and volatile environments can be vast if implemented with accountable governance structures and procedures.

9. Limitations of the Study

The participant pool was smaller than expected and was a key limitation of this pilot implementation. The clinical work-load held by the participants also affected their ability to contribute into the LUOMEAR repository on a regular basis and this could possibly be a future challenge when it is rolled out on a wider scale. There is also a potential that the relevance of some of the risk-sentience records created could become obsolete due to time-related advancements in technology, work practices, or changes in legislation and the possible need to invest in information technology (IT) infrastructure needs to be considered. However, such challenges will be similarly experienced by managers of conventional risk registers, who also require investment in IT and adequate time to administer, monitor, and analyze the data collected.

10. Conclusions and Recommendations

The author would recommend and invite more research in the area of uncertainty and risk-sentience information management and the proposed RSAF’s effectiveness in various other sectors incorporating risk management such as security, engineering, energy, financial portfolios, project management, industrial process, and public health and safety. The proposed framework’s ability to address sources of deep uncertainty including regulatory, economic, environment, cyber-threat, and others within the systems engineering field can also be tested along with other innovative frameworks (Karvetski and Lambert 2012). It would be imperative that professional facilitation and effective communication are prioritised during all stages of the LUOMEAR process to enhance the ability to identify, evaluate, analyze, and respond adequately to the steering signals (Klakegg 2016). Considering that the ISO risk framework is still in its first decade of dissemination, there is immense scope and appetite within the international risk forums for a robust and comprehensive debate on its effectiveness in practice and to discuss any viable proposals and opportunities for improvement within the model.

This pilot trial strived to highlight untapped opportunities by demonstrating with preliminary evidence that by utilizing the newly proposed RSAF and LUOMEAR process, the objective of grass-roots containment of evolving risk-sentience information can be realistically achieved by halting or slowing their progress into an identifiable risk. The study has also demonstrated that the expected secondary benefits of the proposed framework and process could also be improved safety culture and increased non-management employee engagement in the overall risk management process. Considering that our understanding of the concepts of uncertainty and risk and their effective management is a continuously evolving process, our vision should not be to passively adopt a globally prescribed model, but to continually test and further enhance its efficacy with other combinations of evidence-based, innovative risk concepts and frameworks embedded with proven scientific strategies.