Is environmental risk assessment important?
In this post, I discuss environmental risk management, whether environmental risk assessments are necessary, and some of the difficulties in estimating environmental risk.
Under Australian legislation, there is a general environmental duty for all businesses to minimise risk of harm to human populations and the environment from pollution and waste. To achieve this, a business needs to identify and manage all workplace activities that have, or could have, a negative impact on environmental protection of humans and the environment. The outcome of this risk management process is generally recorded in an Environmental Aspects Register or Environmental Risk Register.
Environmental legislation, however, does not require a formal “environmental risk assessment” (i.e. estimation of “consequence” and “likelihood” and calculation of a “risk ranking”) for environmental hazards, nor does ISO 14001:2015 require it. So where does that leave us? I’ll come back to that later, but first an overview of risk management.
The process for managing environmental risks
Environmental risk management is a systematic approach to identifying foreseeable environmental hazards or events, assessing the associated risks to the environment, developing effective risk controls, and periodically reviewing the effectiveness of those controls.
ISO 14001 requires that environmental aspects, compliance obligations, environmental conditions, and the needs and expectations of interested parties within the scope of the Environmental Management System (EMS) be considered in this approach because they are important inputs to the process.
Environmental risk management can be achieved with a simple process that includes four stages:
Stage 1: Identify hazards – Determine what element(s) of your organisation’s activities interact or can interact with the environment, and the nature of the potential environmental impacts.
Stage 2: Assess risks – Estimate the potential consequences of foreseeable environment incidents and the likelihood of these incidents, then calculate a risk rating. (This is generally done as a formal environmental risk assessment – more on that below).
Stage 3: Control risks – Develop and implement effective risk control measure(s) to eliminate or reduce the environmental risks and decide whether ongoing monitoring is required.
Step 4: Review control measures – Periodically review the risk controls to evaluate their effectiveness.
What are environmental hazards and risk?
Environmental hazards are substances, states or events which have the potential to impact the surrounding natural environment or adversely affect human health. Environmental hazards can be natural or man-made.
Environmental risk (also referred to as ecological risks) is usually calculated from the probability and consequence of an unwanted incident.
Some examples of environmental hazards to look out for:
- Hazardous chemicals – inappropriate handling, storage or disposal of substances and materials can cause harmful effects on the general population and the environment. For example, contamination of groundwater and surface waters, soil pollution and release of pollutants into the sewer.
- Biological hazards – people may have potential exposure to airborne diseases and infectious waste through careless handling infectious specimens, contaminated soil or biological materials, or from poor management of cooling towers.
- Waste management – incorrect handling, storage or disposal of industrial waste can contaminate or pollute waterways and harm aquatic organisms. Poor handling and transportation of wastes may also lead to exposure of bacteria, viruses or other disease-causing microorganisms in the air.
- Dust – exposure to dust has the potential to cause respiratory and cardiovascular health complications to humans and harm to plants, animals and ecosystems.
- Fire hazards – Fire and explosions on a worksite can have an immediate threat to the health of neighbours and the environment by producing contaminated runoff, toxic smoke and dust emissions.
- Natural hazards – natural disasters such as earthquakes, hurricanes, floods or avalanches, can lead to pollution due to the escape of hazardous materials.
- Site management – inappropriate site design or layout can result in litter, cigarette butts, surfactants or other pollutants entering stormwater drains and affecting nearby waterways.
- Climate change – changing weather patterns can cause increased flooding which could affect worksites or premises; water scarcity during droughts could also eventually affect plant operations.
- Competency of staff – insufficient or ineffective training, poor training materials, poor delivery or literacy, and language barriers can all contribute to unintended environmental impacts, unexpected costs and damage to an organisation’s reputation.
Other environmental hazards may be sourced from recent environmental audits, past incidents and near-misses, inspections and investigation reports, and especially your environmental compliance obligations. Our online directory, EnviroLaw, provides easy-to-read summaries of all environmental legal obligations including council laws.
Download your free ISO 14001 documentation sample pack
What other activities can give rise to environmental hazards?
Environmental hazards arising from onsite physical processes and the physical work environment might be easy to identify. But there may be other activities contributing to your hazards that aren’t so obvious and easily overlooked (some examples are shown below). An environmental legal compliance audit may be helpful in determining all your environmental hazards.
Potentially overlooked activities include:
- physical processes involved in equipment startup, shutdown and maintenance
- outsourced processes, i.e. work performed by a third party but under your control or influence
- off-site activities of staff or others acting on the organisation’s behalf
- foreseeable emergency situations
- unusual environmental conditions (for example, fire, earthquake or power outages).
How to conduct an environmental risk assessment
Stage 2 of the risk management process given above (“Assess risks”) includes environmental risk assessment (also referred to as quantitative risk assessment). The most common way to estimate environmental risk is by using a risk matrix to determine a risk rating for each environmental hazard.
The three steps for a risk assessment are as follows (follow these steps for each environmental hazard):
Step 1 – Determine the worst-case consequence
- Decide the most serious foreseeable consequence for the hazard.
- Estimate a consequence rank (1-5) for this consequence against each of the five risk categories.
- The consequence with the highest consequence rank across all five risk categories will be used in Step 2.
| Risk categories | Consequence rank and description | |
| Environmental harm | (1) Insignificant: (2) Low: (3) Moderate: (4) High: (5) Extreme: |
None or insignificant Minor short-term Significant short-term Significant long-term Large-scale long-term |
| Legal noncompliance | (1) Insignificant: (2) Low: (3) Moderate: (4) High: (5) Extreme: |
Minor or none May result in a small fine May result in a large fine Possibly lead to prosecution Probably lead to prosecution |
| Corporate image | (1) Insignificant: (2) Low: (3) Moderate: (4) High: (5) Extreme: |
No damage Minor damage Significant damage Possible major damage Probable major damage |
| Interested parties | (1) Insignificant: (2) Low: (3) Moderate: (4) High: (5) Extreme: |
No concern Minor concern Moderate concern Possible major concern Probable major concern |
| Cost | (1) Insignificant: (2) Low: (3) Moderate: (4) High: (5) Extreme: |
No remediation cost Minor remediation cost Significant remediation cost Possible major remediation cost Probable major remediation cost |
Step 2 – Determine a likelihood ranking
- Estimate the likelihood rank (1-5) for the consequence with the highest consequence rank (from Step 1).
| Likelihood ranking | Ranking descriptions |
| (1) Rare | Could occur but only in exceptional circumstances |
| (2) Unlikely | Could occur at some time (in normal circumstances) |
| (3) Possible | Could occur from time to time (in normal circumstances) |
| (4) Likely | Will probably occur with some regularity |
| (5) Almost certain | Is expected to occur often |
Step 3 – Determine an overall environmental risk rating
- Plot the highest consequence rank (Step 1) against the likehood rank (Step 2)
- Where they meet is the environmental risk rating for that hazard.
- For example, if the highest consequence rank is 4 and the likelihood rank is 3, then the environmental risk rating is medium.
Calculating inherent and residual risk
When managing risk, two different risk assessments are often used. One is “inherent risk”: this is an estimate of risk assuming no controls are place. The second is “residual risk”: this is an estimate of risk assuming all risk controls are implemented and effective. Both types of risk assessments usually use the same consequence ranking (recognising that controls can fail), and it is the likelihood that differs.
In my consulting work, I do not recommend “inherent risk assessment” because estimating the “likelihood” of an incident when there are not controls is too difficult. For starters, what does “without risk controls” mean? We can imagine a scenario where physical safeguards are not present (e.g. bunding), but do we also assume there are no procedures, no training, no common sense – where do we stop with this? And because we probably have no data or experience to base our likelihood estimates on, we cannot objectively assess inherent risk.
A “residual risk assessment” is also not easy in many cases. If risk controls have recently been put in place and there is no history of incidents to draw on, how can the “likelihood” of an incident be assessed? One can only make guesses.
So, is environmental risk assessment important?
If risk managers need to identify many environmental hazards, then prioritisation of environmental hazards is needed, and environmental risk assessment has a role to play. I propose two options for prioritising risk control work.
The first is to assess the consequence and likelihood using a process like that given above.
The second option is to use only the consequence and prioritise on consequence alone. This is what I recommend to many of my clients because it avoids the time-consuming work of trying to guess likelihoods
Use an environmental risk assessment process with ISO 14001
Neither Australian legislation or ISO 14001 requires estimation of a risk-rating per-se. ISO 14001 does require some grading of risk to determine the “significance” of environmental aspects (hazards). The second option (estimation of consequence alone) is compliant with this ISO 14001 requirement because the standard does not specify how significance is to be determined rather leaves that to the organisation to decide.