Training Employees in Risk Awareness and Mitigation

Risk management involves identifying, assessing, eliminating and/or mitigating risks. It is an essential aspect of operations in all types of organisations across all industry sectors irrespective of their size as it helps to prevent accidents, losses, disruptions and possible non-compliance that can affect, for example, an organisation’s productivity, finances and reputation. 

Although risk management is a management process, taking a whole organisation approach can provide valuable insights and suggestions for improvement. When employees at all levels of an organisation are involved in identifying risks and making suggestions for elimination and mitigation, it can foster a culture throughout the organisation of vigilance, quality and safety.

Understanding Workplace Risks

Every day organisations face risks. The types of risk, the likelihood of it happening, the severity and impact of the threat, and the processes in place to eliminate or mitigate the risks can vary vastly from industry sector to industry sector and even from organisation to organisation. Risks that are common to all organisations irrespective of their industry sector, or even size, include but are not limited to:

• Cybersecurity risks
• Operational risks
• Financial risks
• Compliance risks
• Reputational risks
• Health and safety risks

Often these risk areas are interconnected; for instance, should it occur, a health and safety risk may also have financial, reputational, operational and compliance implications, therefore there are risks in these areas too. For example, in a food processing organisation, there might be a risk of injury from equipment. Should an injury occur, it may cause the production line to be shut down, leading to an investigation and financial loss. If the employer is found to be negligent then they may be prosecuted and fined and their reputation may suffer. 

Currently, cybersecurity is the number one business risk, with 50% of all organisations having experienced some form of cyber attack in the last 3 years. Phishing has been identified by experts as one of the major cybersecurity risks. Cybersecurity includes data protection and the GDPR, and ensures the protection of the organisation’s assets, its people and the people whose data it processes. 

Operational risks pose a significant threat to organisations. These risks can arise from various sources, including internal processes, systems or equipment failures, human error, and external events. These risks can include, but are not limited to, supply chain disruptions, employee turnover, equipment breakdowns, lack of training etc. 

Financial risks might include the possibility of losing money on an investment or business venture. Some more common and distinct financial risks include credit risk, liquidity risk and operational risk which can result in the loss of capital. Money laundering and bribery are also common potential financial risks.

Regulatory compliance refers to adhering to laws, regulations and standards set by the government and industry bodies. Compliance risks arise from not having, or not following procedures that should be in place to ensure compliance. For example, the risk of non-compliance with disciplinary procedures might be discrimination and/or unfair dismissal resulting in legal action at an employment tribunal. 

Reputational risk is a threat or danger to the good name or standing of a business or entity. Reputational risk can occur directly, as the result of the actions of the organisation, indirectly, due to the actions of an employee or employees, or tangentially, through other peripheral parties, such as joint venture partners or suppliers. Reputational risk can occur through a variety of ways; it might occur through being socially or environmentally irresponsible, or from the actions of errant employees, such as fraud, or through the illicit actions or practices of, for example, a supplier which tarnishes the organisation’s reputation by association. 

Health and safety risks need to be considered in all aspects of the working environment. They might include hazards such as electrical safety, fire safety, manual handling, hazardous substances, and risk factors for repetitive strain injury, stress or violence. They may also involve organisational factors such as staffing policies, systems of work, equipment, management techniques or working hours, shift patterns or lone working.  

Risk is a broad category, with varying levels of threat to an organisation, from minor inconvenience to potentially putting an organisation’s very existence in jeopardy. It applies to any event or circumstance that has the potential to cause harm and prevent an organisation from achieving its goals or objectives. Every organisation faces a unique set of risks that it needs to plan for. Without identifying risks, it is difficult to successfully plan strategically and carry out everyday operations. The key to identifying these risks is to conduct a thorough risk assessment, utilising every available source of data and information, including the involvement of the organisation’s employees.

The Importance of Employee Involvement

Risk identification, assessment, elimination and/or mitigation requires a continuous flow of data and information from up, down and across an organisation, and constant monitoring by managers. The input of all employees is a critical resource that should not be underestimated as employees at all levels in an organisation are often the first to see potential hazards or threats, and/or are often the ones affected by the risks. 

Collaboration with employees at all levels in an organisation helps the organisation to manage risks in a practical way by helping to spot workplace hazards and/or threats that they may encounter in the course of their work, giving a more comprehensive and accurate evaluation of potential hazards. This can improve the quality and accuracy of the risk identification and assessment. Their familiarity with the specific tasks and processes can lead to the identification of subtle, yet significant, risks that might not be evident to others. These hazards or threats may be overlooked, underestimated or missed altogether by anyone not carrying out the role on a regular basis. 

When all employees are involved in the risk management process, it helps to foster a culture of risk awareness, engagement and ownership and can motivate all employees to be vigilant and to take responsibility. Their direct experience and knowledge of the potential hazards, threats and risks in their work environment can provide valuable insights and suggestions for improvement.

Employees’ involvement in risk identification and assessment increases the likelihood that they will adhere to and support the implementation of mitigation strategies, fostering a safer and more compliant work environment. 

Involving employees in identifying hazards and potential risks has measurable benefits for organisations. For example, accident rates are lower in organisations where employees genuinely feel that they have a say in health and safety matters (14%), compared with workplaces where employees don’t get involved (26%).

It is not only health and safety risk matters that employees can contribute to; employee insight can be the first line of defence in other risk assessments too. For example, in some industries, regulatory requirements may mandate employee involvement in risk assessments. Ensuring compliance with these regulations is not only a legal obligation but also a way to demonstrate a commitment to employee engagement.

When employees are actively engaged in identifying and assessing risk, it opens communication channels which can lead to employees being more likely to communicate concerns, report incidents and share valuable information about potential risks as they feel they are part of the risk management process.

Risk Assessment

Every organisation will face different types of risk. These might be internal, external, strategic and those arising from major projects. 

Internal risks are risks over which the organisation has some control, for example risks that can be managed through internal controls and, where necessary, additional mitigating actions. Examples of internal risk might include, but are not limited to:

• Fraud
• Health and safety
• Capacity and capability
• Data security
• Equipment
• Delivery partners

External risks are risks over which the organisation has little or no control. Consider the impact that those external events could have on, for example, the infrastructure, finance, people, operations and reputation etc. This forms a business continuity plan. Examples of external risk might include, but are not limited to:

• Economic downturn
• Terrorist attack
• Extreme weather
• Cyber attacks
• Global pandemic

Strategic risks refer to the risks that threaten an organisation’s ability to deliver expected outcomes. Examples of strategic risk might include, but are not limited to:

• Immediate impact risks to the organisation’s ability to continue operating, for example data governance and cybersecurity, business conduct, ethics and reputation
• Slow-burning risks that grow and eventually prevent delivery of objectives, for example key personnel turnover or leadership capability, political, economic and market exposure

Risks have three elements:

• A definite cause
• An uncertain outcome
• An impact/effect on someone or something

Risk assessment is simply a careful examination of what could cause harm (that is, a hazard or a threat) to someone or something, and requires making a judgement on the risk severity, so that the organisation can weigh up whether they have taken enough precautions to either eliminate or mitigate the risk, or whether they should do more to prevent harm.

A hazard or threat is anything that may cause harm. A risk is the chance – high, medium or low – that someone or something could be harmed by these and other hazards or threats, together with an indication of how serious the harm could be. There is a simple formula used:

Risk Severity = the probability of a risk materialising X the impact of a risk on, for example, the business, employee(s), client(s) and/or stakeholder(s) interests.

Probability is the likelihood that the risk might happen, and may be understood as:

• Low (Level 1) – a reasonably informed person would think it very unlikely this risk would materialise in the foreseeable future
• Medium (Level 2) – a reasonably informed person would think there is a significant possibility this risk would materialise in the foreseeable future
• High (Level 3) – a reasonably informed person would think there is a very significant or even likely possibility the risk would materialise in the foreseeable future

Impact may be understood as:

• Low (Level 1) – any impact on the organisation as a business, its employees, workers, contractors, clients or stakeholders is minimal having regard to the importance of interests affected, impairment of function and duration. Typically, the impact is isolated and short-lived.
• Medium (Level 2) – any impact on the organisation as a business, its employees, workers, contractors, clients or stakeholders is significant having regard to the importance of interests affected, impairment of function and duration. Typically, the impact is limited to one function or group, but there is a material operational impact and the effects may continue.
• High (Level 3) – any impact on the organisation as a business, its employees, workers, contractors, clients or stakeholders is severe having regard to the importance of interests affected, impairment of function and duration. Typically, the impact impairs a critical function and/or has a systemic impact and the effects may be long-lasting or permanent.

This forms the Risk Matrix.

The risk assessment process, irrespective of the type of risk, involves a five-step process:

Step 1 – Identify the hazards or threats – these are things that could reasonably be expected to cause harm. They will depend upon what type of risk is being assessed. 

Step 2  Decide who or what might be harmed and how – be clear about who or what might be harmed by each hazard or threat. This helps to identify the best way of managing the risk.

Step 3 – Evaluate the risks and decide on precautions – can the risk be eliminated or what needs to be done to control the risk so that harm is unlikely?

Step 4 – Record the findings and implement them – a risk assessment report and implementation plan will enable everyone in the organisation to understand the risks and control measures that have been put in place. It is also important to keep this record in the event of compliance inspections.

Step 5 – Review the assessment and update if necessary – managing risk is an ongoing process that is triggered when changes affect the organisation. These changes may include, but are not limited to:

• Workforce change
• Changing work practices, procedures or the work environment
• Purchasing new or used equipment or using new substances
• Planning to improve efficiency or reduce costs
• New information about workplace risks becomes available
• Responding to concerns raised by employees, workers, contractors, clients, visitors or others at the organisation

Employees at all levels can be involved with this process by creating a collaborative approach to identifying and mitigating risks in the workplace. A good starting point is to provide employees with training on risk assessment procedures, hazard identification, and the importance of their involvement. Ensure that they understand the goals and processes involved in assessing and mitigating risks.

Design and implement an accessible and user-friendly system for reporting hazards, threats or risks. This may take the shape of a simple suggestion box, or an online reporting platform or notices signposting people to the person responsible for risk management. The key to engagement at this level is to demonstrate that reported hazards, threats and risks are acknowledged and considered for action. For example, if an employee was to report a security risk because some employees displayed their passwords on Post-it notes on their computer screens, they would have an expectation that management would notify employees to not do this in order to eliminate the risk. However, if this does not happen and the employee still sees the password Post-it notes displayed, they may be reticent in future to report any risks, thinking management is not interested, which is a risk in itself. Utilising technology such as mobile apps, digital platforms or online reporting tools can make it easier for employees to actively participate in risk identification and assessment. Technology can streamline the reporting process and provide real-time insights.

Create an organisational culture that encourages open dialogue and emphasises the importance of sharing information related to any risks noticed, and of continuous improvement based on feedback from employees. This reinforces the idea that their active participation contributes to ongoing risk identification, elimination and/or mitigation.

An initiative such as a “workplace walk-through” can be a very effective way for all employees to contribute to risk identification and mitigation. These can be done in a variety of ways and from a range of perspectives. For example, employees can analyse their tasks and work processes to identify potential risks, or job observations can be arranged where employees can actively observe and report on work practices, identifying any areas for improvement to mitigate risk. Employees could also take the role of a “mystery shopper”, looking at services and practices from the perspective of service users or customers to identify risks to the organisation. 

Many organisations form risk committees with representation from different departments and levels within the organisation. These committees can meet regularly to discuss risk concerns, review incidents, and contribute to the development of risk mitigation strategies. Alternatively, an organisation can arrange regular meetings, focus groups and workshops, where employees can actively discuss potential risks associated with their work area. These sessions can provide a platform for employees to share their insights and experiences regarding risk issues.

Training Needs Analysis

In order to ensure that any training initiative has the potential to be effective, a training needs analysis should be carried out. A training needs analysis is used to correctly identify what and/or who needs to be trained. Training needs analyses that are poorly conducted can lead to training the wrong knowledge, competencies or skills, the wrong people and/or using the wrong or inappropriate training methods.

When conducting a training needs analysis, the following questions need to be answered:

• What is needed and why?
• Where is it needed?
• Who needs it?
• How will it be provided?
• How much will it cost?
• What will be the business effect (the desired outcome)?

When performing a training needs analysis for risk awareness and mitigation training the first step would be to articulate the goal of the training, for example:

“To develop employees’ skills and confidence to identify, analyse, prioritise and mitigate risks.”

The training goal will depend upon the level of involvement the organisation needs various employees to have in the risk management process. But the training goal needs to be specific, and can apply to an individual employee, work team, department or the entire organisation. 

Whilst the process of risk identification and assessment will be generic, the hazards and threats that pose a risk and the people or things that may be harmed will differ depending upon risk type. These risk types may be applicable to the whole organisation or to particular areas, so training may need to be tailored to cover specific needs. 

Once the goal has been articulated, the next step is to identify the desired critical competencies, behaviours, skills and associated knowledge that are required to achieve the training goal. For example, by the end of the training employees will be able to carry out a risk assessment.

The next step is to identify the gap between what the employee(s) already knows and the skills that they may already have and what they need to have in order to achieve the training goal. For some, this might only mean providing a refresher as their knowledge and skills may be at the level that you require. For others, a more in-depth training initiative may be more appropriate. 

The level of training may also vary according to the level of the employee. For example, team members may only require an introductory level training, whereas managers may require a more comprehensive programme. This decision will be based upon the employee’s level of responsibility, accountability and engagement required.

Effective Training Methods

Training employees on risk awareness and mitigation is crucial for creating a proactive approach to risk in the work environment. The first step is to clearly define the goals and objectives of the training programme and to specify the knowledge, skills and behaviours that participants should acquire by the end of the training. The next stage is selecting the appropriate training delivery methods and formats. This is important to ensure that employees engage with the training and can easily transfer the knowledge and skills gained back into the workplace. Training methods that can be utilised include:

• E-learning modules and courses can be accessed by employees at their convenience. These modules can include multimedia elements, quizzes and scenarios to enhance engagement and understanding of key risk concepts. These can be used as a mandatory training element of induction for new employees and for refreshers for all other employees.
• Face-to-face classroom-type training sessions, in-person or online led by experienced facilitators can cover the fundamental concepts of risk management, industry-specific risks, and best practices for mitigation. This format allows for a mixture of knowledge input as well as direct interaction such as simulations and role-playing, interactive workshop scenarios, case study group work, and question and answer (Q&A) sessions. These sessions might also include input from external experts or guest speakers to share their experiences and knowledge on specific risk topics.
• Webinars help to facilitate remote learning and can include interactive elements such as polls, chat discussions and Q&A sessions.
• Incorporating risk awareness and mitigation training into regular on-the-job training and coaching ensures that employees receive relevant information and skills tailored to their specific roles and responsibilities.
• Conducting regular drills and exercises to simulate emergency situations such as fire drills or emergency evacuations allows employees to practise procedures and to identify any potential risks to the procedures. These drills should be followed by “sash-up” sessions allowing all employees to feed back on what went well, what didn’t and suggestions for improvements.
• Some organisations are using gamification to enhance their training provision. Gamification works by providing employees with proactive directives and feedback through game mechanics and game dynamics added to online platforms such as challenges, rewards and competitions that lead to the accomplishment of business goals and objectives. Gamified training can enhance engagement and motivation while reinforcing key risk awareness concepts.

Combining various training methods ensures a comprehensive and engaging approach to building risk awareness and mitigation skills among employees. Interactive training encourages active engagement, and activities such as simulations, role-playing and hands-on exercises make the learning experience more enjoyable and memorable and provide opportunities for skill development. Practical training prepares employees for real-world challenges by exposing them to scenarios they may encounter in their daily work.

Compliance and Regulations

Compliance with industry regulations and standards is an integral part of an effective risk management strategy and helps organisations identify, assess and control risks more effectively. Compliance helps mitigate operational, financial and legal risks. Local, national or international regulatory authorities often set legal obligations which failure to comply with can lead to legal consequences, including fines, sanctions and potential shutdowns, which can result from risk and regulatory violations. 

Examples of industry regulations and standards might include, but are not limited to:

• The Data Protection Act and UKGDPR applies to all workplaces, business ventures, societies, groups, clubs and enterprises of any type.
• The Health and Safety at Work etc. Act 1974 (HASWA) applies to all business sectors, and it is therefore the responsibility of the employer to ensure that health and safety is effectively managed within the workplace.
• The Food Standards Act 1999 and the Food Safety Act 1990 sets standards and regulations for the food industry.
• The Financial Conduct Authority regulates and oversees compliance for the financial sector.
• The Control of Substances Hazardous to Health Regulations (COSHH) 2002 applies to all business sectors.
• The Office for Standards in Education, Children’s Services and Skills (Ofsted) regulates schools, colleges, nurseries etc.
• The Care Quality Commission (CQC) regulates health and social care.

Industry regulations often mandate specific risk assessment processes. By following these guidelines, organisations systematically identify and assess potential risks associated with their operations. All employees and workers need to be made aware of the standards and regulations that govern the specific industry sector that they work in, and how to identify and report any risks of non-compliance to the appropriate person.

Communication and Reporting

Establishing transparent and effective communication channels for all employees to report identified risks helps to strengthen an organisation’s overall risk management process. Benefits to employers of establishing these channels and encouraging employees to use them without any fears of penalty or reprisal can include:

• The early detection of issues. Employees who feel comfortable reporting concerns are more likely to share information about, for example, unsafe practices, equipment failures or other issues before they escalate. This helps prevent the escalation of minor issues into major incidents.
• Clear communication channels for reporting contribute to the development of a risk awareness and practice improvement culture within the organisation. When employees understand the importance of reporting risks and incidents and experience a commitment to addressing identified issues, they are more likely to prioritise risk awareness and reporting in their daily activities. This builds trust within the organisation, as when employees recognise that their reports are taken seriously and acted upon, they are more likely to trust the organisation’s commitment to risk management.
• Clear communication channels help organisations to meet legal and regulatory reporting requirements. Compliance with legislation, regulations and standards is essential for avoiding legal repercussions and maintaining a positive reputation within the industry and wider community.
• Clear communication channels empower employees, enhance decision-making and contribute to the overall effectiveness of risk management in the organisation.

All employees have the responsibility to be honest, ethical, safe and lawful in everything that they do at work, and speaking up about any risks concerns that they may have at work is really important. It is vital to maintain high standards, make improvements and remain compliant. All employees should be informed that they should be able to raise genuine concerns without fear of reprisals, even if they turn out to be mistaken. ‘Speaking up’ is the term used when an employee raises a concern. It is useful for organisations to develop a speaking up policy and procedures to encourage employees to raise risk concerns, with guidance as to how to raise those concerns and assurance that reports will be investigated to assess and manage the risk.

All employees have the responsibility to be honest, ethical, safe and lawful in everything that they do at work, and speaking up about any risks concerns that they may have at work is really important. It is vital to maintain high standards, make improvements and remain compliant. All employees should be informed that they should be able to raise genuine concerns without fear of reprisals, even if they turn out to be mistaken. ‘Speaking up’ is the term used when an employee raises a concern. It is useful for organisations to develop a speaking up policy and procedures to encourage employees to raise risk concerns, with guidance as to how to raise those concerns and assurance that reports will be investigated to assess and manage the risk.

Crisis Response Training

Crisis response training builds the foundation for an organisation’s ability to act quickly in the face of an unplanned event. It helps employees to prepare for the unexpected and to be able to react to a crisis swiftly, with a cohesive, consistent response across the organisation. A crisis management training programme outlines a series of scenarios that an organisation needs employees to be familiar with, and steps that they should take should it occur. Depending on the type of business and industry sector, crisis response scenarios might include, but are not limited to:

• Cyberattacks – these can range from anything from employees accidentally downloading malware that ends up in the organisation’s network to hacking an organisation’s social media accounts and website, or having confidential data, either the organisation’s, their customers’ or service users, or employees’, breached and, worse, leaked online through a phishing attack.
• Unexpected downtimes – these may be caused by a range of situations such as equipment malfunctions or failures, technology failures that affect online business services, strikes, either internal or external, and environmental events such as floods etc.
• Fire – if an organisation has experienced a fire at its premises, it has experienced a crisis. This could cause the organisation to lose money because it could destroy valuable equipment or inventory, and it could cause expenses such as repairs or relocation.
• Reputational crises – such as complaints shared on social media, harm caused to employees or members of the public through unforeseen accidents, negligence caused by the organisation or its employees, and sabotage caused by external or internal factors.

Crisis management is something that every organisation needs to implement as part of its business and risk management processes. It is an essential component of business continuity planning. The first rule of crisis management is to avoid a crisis. This can be done through effective risk identification, assessment and management. The second rule is to be prepared for a crisis when it happens. When faced with a major problem, the first priority should be to fix the immediate situation and then devote all available resources to damage control. These actions should be detailed in a crisis management plan for mitigating the effects of the crisis.

All employees can be trained to contribute to the crisis management plan in much the same way that they contribute to risk identification, assessment and management. Every employee should be made aware of their specific roles, responsibilities and actions that they should take in the event of a crisis in order that they assist rather than hinder crisis management.

Continuous Improvement

Risk management requires continuous improvement. It not only allows an organisation to keep any threats in check, but it also helps it to improve the risk management process. Continuous improvement in risk management involves learning from past incidents or near misses and adapting strategies accordingly. 

Risk reporting channels as discussed above, can serve as a foundation for continuous improvement. By regularly analysing reported risks and incidents, organisations are able to refine risk management strategies, update safety procedures, and adapt to evolving challenges.

Measuring Training Effectiveness

As with other training and development initiatives, it is crucial that risk awareness, risk assessment and management training initiatives are assessed and evaluated to determine whether they are achieving their intended goals, to measure their effectiveness in contributing to overall risk management and to calculate the return on investment. 

There is a range of assessment and evaluation methods that can be used to measure training effectiveness. These include:

• Comparing the results of pre- and post-training skills and knowledge assessments. This provides insights into skills and knowledge improvement.
• Integrating knowledge checks, quizzes or interactive elements during the training to assess participants’ understanding of the training content in real time.
• Practical skills assessments related to risk management through hands-on exercises, simulations or role-playing will allow the assessment of participants’ ability to identify, assess and mitigate risks in real-world scenarios.
• On-the-job observational assessments of employees in their work environment to see if they are applying the risk management principles and skills learned during training to their work.
• Conducting follow-up assessments weeks or months after the training to measure knowledge and skills retention over time. This helps determine the long-term impact of the training on participants’ understanding and application of risk management procedures.
• Evaluating whether the benefits resulting from the training, such as reduced incidents or improved compliance, outweigh the costs associated with implementing the programme.
• Observable changes in employee behaviour regarding risk awareness and reporting can help to evaluate training effectiveness, monitor the use of communication channels to flag risk, and examine how employees’ actions regarding risk may have altered or improved following training. A decrease in incidents or an improvement in the reporting of potential hazards and threats may indicate that employees are more aware of risks and are actively participating in risk reporting.
• To gain a deeper understanding of the training’s influence on behaviour and decision-making, conduct focus groups to gather qualitative insights into the impact of the training on their day-to-day work.

Effective training assessment and evaluation comprises using a range of measurement methods to gain a rounded perspective on the benefits of training, and provide helpful insights into whether the training initiative requires refining or developing further to optimise effectiveness.

Conclusion

Risk awareness, reporting, assessment and mitigation training is essential for all employees to ensure that an organisation is equipped to manage risk in the most effective way and for creating a safe, compliant and resilient work environment.

Risk management, as we have seen earlier in this article, is an ongoing process that requires continual review and improvement to ensure it meets the needs of the organisation, its employees and all stakeholders.

Similarly, training and development is an ongoing process that also requires continual review and improvement to ensure that participants are able to apply the skills, knowledge and behaviours developed through training effectively back into the workplace. As workplaces evolve and change, employees will require updates and refresher training to ensure that they have the most up-to-date information and that they maintain their optimum skill levels to help the organisation successfully manage risk.