Pandemic risk management; protecting people while ensuring business continuity

Abstract

The COVID‐19 pandemic swept across the globe in the latter half of 2019, throughout 2020 and into 2021. In response, many organizations implemented work from home policies, while others stopped operations entirely in an effort to limit the spread throughout their workforce and supporting communities. This containment strategy was not universally viable; long‐term shutdowns impacted the economic viability of companies, and some industries were designated as an “essential service” and thus continued operations. These employers faced the proposition of balancing the needs of the business and the community with a continued responsibility to provide a safe workplace for employees. This paper demonstrates how the application of common risk management methodologies, such as bowtie analysis combined with an appropriate assurance and verification process (e.g., the lines of defense model), can help the risks associated with a resumption or continuation of in‐person operations in a pandemic to be better understood and ensure the measures in place to manage said risk are appropriate and effective.

1. PANDEMIC RISK MANAGEMENT; AN INTRODUCTION

Since its appearance in December 2019, the SARS‐CoV‐2 virus (COVID‐19) has continued to spread, touching almost all corners of the world. The progression from outbreak to pandemic was soon accompanied by the swift imposition of lockdowns in many countries.

In support of the various restrictions imposed upon their communities, many organizations implemented work from home policies, while others stopped operations entirely in an effort to limit the spread. There were, however, industries where this approach was not viable, either because they provided an essential service or because of economic necessity. Now, more than a year on from coronavirus initially upending daily life and work, this situation remains.

Employers requiring their employees to remain in, or return to, an office environment, work site or operating facility face the ongoing proposition of balancing the needs of the business and the community with a continued responsibility to provide a safe working environment for their employees.

Common risk management methodologies, such as bowtie analysis combined with the lines of defense (LOD) model, can be adapted to help employers better understand the risks involved with a resumption or continuation of in‐person operations, ensuring the measures they have in place to manage this risk are appropriate and effective.

2. BOWTIE ANALYSIS

2.1. Introduction to bowtie analysis

Risk assessment lies at the heart of any form of risk management, and one of the most powerful of these techniques is the bowtie method. Its strength is that it goes beyond the usual risk assessment “snapshot” and highlights the links between controls, assurance and verification activities, and the underlying management system; a valuable trait when assessing the constantly evolving nature of a pandemic.

Bowties originated as a method for assessing operational risk, with the earliest mention of such an approach appearing within an adaptation from the ICI plc HAZAN Course Notes 1979, presented by The University of Queensland, Australia. ¹ The Royal Dutch Shell Group was the first major company to integrate the bowtie method into its business practices ² , ³ , ⁴ and is credited with developing the technique which is widely used today.

The bowtie method provides a readily understood visualization of the relationships between the causes of business upsets, the escalation of such events, the controls preventing the event from occurring, and the mitigation measures in place to limit the business impact (see Figure 1).

FIGURE 1.

Bowtie framework

A description of the different components of the bowtie, and the method for building such a diagram are well‐documented, ² , ³ , ⁵ hence this paper focuses predominantly on its specific application within a pandemic risk management setting. Select definitions, within this context, are provided in Section 2.2, below.

2.2. Application of bowtie methodology to pandemic risk management

The application of bowtie methodology can be shifted from its more traditional use in high‐hazard industries to assessing the risk to an organizations workforce during the COVID‐19 pandemic in a relatively straightforward manner. Through graphical representation, bowtie analysis can map threats that may impact worker safety, identify and assess the safeguarding in place to prevent or mitigate different scenarios, and readily highlight any deficiencies or non‐conformances.

A representative example of how the bowtie methodology can be applied in the assessment of “worker safety” is provided in Figure 2, with select key definitions and accompanying examples outlined in Table 1.

FIGURE 2.

COVID‐19 worker infection example

TABLE 1.

Bowtie definitions

Component	Definition	COVID‐19 bowtie example
Top event:	The moment when control of a hazard is lost (e.g., loss of control/containment of the hazard).	Infection with the SARS‐CoV‐2 virus was designated as the top event.
Threats:	Potential causes which could directly and independently result in the top event and are listed on the left‐hand side of the bowtie diagram.	Representative causes which could lead to infection with the SARS‐CoV‐2 virus include: Close contact with infected person(s) during work hours. Close contact with infected person(s) in work camp.
Consequences:	Negative events which could result from the top event and lead to harm or damage. These are listed on the right‐hand side of the bow tie diagram.	Representative consequences resulting from infection could include: Respiratory illness with severe health outcome. Infection of multiple other persons (spread).
Prevention barriers:	Barrier that prevents the top event from occurring and is located between the applicable threat and top event on the left‐hand side of the bow tie diagram.	Representative prevention barriers could include: Social/physical distancing—maintaining proper distancing in certain environments will help prevent spread. Face masks—face coverings can help prevent transmission of any airborne virus particles between individuals.
Mitigation barriers:	Mitigation barriers are employed after the top event occurs and will reduce the magnitude of the consequence. These barriers are located on the right‐hand side of the bow tie diagram.	Representative mitigation barriers could include: COVID‐19 testing (inc. viral, antibody etc.) helps identify infection and directs subsequent activities to manage individual's health and prevent spread. Vaccinations—CDC approved vaccinations will help prevent hospitalizations and potential fatality following COVID‐19 infection. Current understanding is that infections can still occur post vaccination and, as such, this has been designated as a mitigative barrier.
Degradation factors:	Factors that may defeat or reduce the effectiveness of a barrier are termed degradation factors. These are applied as necessary throughout the bowtie diagram.	Representative degradation factors could include: Personnel unable to work from home (site‐based function) Increase in personnel on site (e.g., during turnaround), reduces capability for appropriate social distancing.

3. RISK MANAGEMENT FRAMEWORK

Bowtie analysis is not a panacea for managing risk in the current environment. It must be integrated within a wider risk management framework, enabling barrier implementation to be controlled and the risk profile for the organization to be consistently monitored.

The adoption of such a framework is of special significance to large organizations who face the following challenges:

1. How do we coordinate our response in a consistent manner across multiple facilities and offices?

2. How do we provide a large and geographically diverse workforce with readily available information on our response and the resources available?

3. How do we map and track compliance of safeguarding to ensure conformance and identify any deficiencies?

The following features of bowtie analysis, and its application within a robust risk management framework help address these challenges.

3.1. Pandemic response communication

The bowtie is an excellent communication tool for the coordination of response. Dissemination of key information to the workforce can be actively managed via targeted outputs from the bowtie diagrams.

Information for each barrier on the bowtie diagram can be easily and swiftly communicated to the workforce in a one‐page summary (Figure 3), ensuring a coherent and well‐informed response, covering questions such as:

• What is the barrier?

• What does it do?

• How does it perform?

• How is it tested?

• Where do I find documents with further information?

• Who should I contact for further details?

FIGURE 3.

COVID‐19 safeguarding summary

3.2. Barrier/safeguarding assurance and verification

In order to track how well prevention and mitigation barriers are performing, assurance and verification criteria must be defined as benchmarks to measure success. Such criteria are commonplace within high hazard industries in the form of Performance Standards. However, a more appropriate approach for managing the COVID‐19 response is the three LOD model.

The LOD model is typically deployed in an internal auditing function. ⁶ LOD modeling is a method used to gauge performance, enhance clarity regarding risks and controls, and help improve the effectiveness of risk management systems. It is based around three broad concepts (Figure 4):

• LOD1: Self‐verification that activities have been completed as prescribed. Barriers are effectively controlling risks and are delivering planned performance;

• LOD2: Independent functional assurance of conformance to requirements and quality of operating activities; and,

• LOD3: Internal, external and regulatory audits to confirm compliance.

FIGURE 4.

Lines of defense model

The LOD model can be applied to the prevention and mitigation barriers identified within the bowtie in the following manner:

1. Identify assurance and verification activities for each barrier;

2. Disseminate these criteria to operating locations, offices, entities in questionnaire format for completion by site representatives (see Figure 5);

3. Collate responses within the auditing function of the bowtie software used (e.g., BowTieXP); and

4. Display and monitor location performance using a key performance indicator (KPI) dashboard (see Figure 6).

FIGURE 5.

Self‐verification (LOD1) checklist example

FIGURE 6.

Key performance indicator (KPI) dashboard example

3.2.1. KPI dashboard

The application of the LOD model to COVID‐19 response enables a real‐time view of the health of barriers, ensuring all non‐conformances and deficiencies are highlighted, together with a risk profile for each facility, office, or entity under consideration.

KPI's, are defined as a quantifiable measure used to evaluate the success of an organization, employee, and so forth in meeting objectives for performance. KPI's are traditionally applied to “Safety Critical Elements” within the process industry and help ensure that said equipment is being tested, maintained, and inspected at an appropriate interval, and remains robust through life. The assurance and verification activities for typical COVID‐19 prevention and mitigation barriers are relatively more straightforward and can be represented via a simple traffic‐light designation which can serve to easily and effectively highlight how the identified barriers are being adopted across an organization;

• Green: Barriers are fully implemented, with all self‐verification activities complete.

• Amber: Partial implementation of barriers. Self‐verification activities indicate some deficiencies which can, and will be, resolved.

• Red: Barriers not implemented / multiple deficiencies identified.

A representative example of a KPI dashboard is depicted in Figure 6.

4. CONCLUSION

COVID‐19 continues to present a unique and challenging environment for society and industry alike. As organizations continue operations, begin return‐to‐work preparations, or simply prepare for the everchanging restrictions placed upon them, the need to manage the risks inherent in such activities is paramount.

Bowtie analysis, and its application within an integrated risk management process, can help us better understand and manage these risks by:

• Ensuring that the key hazards have been identified and appropriately assessed; including correct identification of threats, consequences, and both preventive and mitigative barriers;

• Developing, implementing, and tracking a set of assurance and verification tasks, in line with the LOD model, to ensure performance of the identified barriers;

• Highlighting any deficiencies in safeguarding, or non‐conformances with the developed assurance and verification tasks, and

• Ultimately providing assurance that the identified risks are being managed / mitigated in a manner which is considered to reduce this risk to an acceptable (or As Low As Reasonably Practicable—ALARP) level.

Sneddon J. Pandemic risk management; protecting people while ensuring business continuity. Process Saf Prog. 2022;41(1):8-13. 10.1002/prs.12302

DATA AVAILABILITY STATEMENT

Data sharing is not applicable to this article as no new data were created or analyzed in this study.