Proper risk management: the key to good decisions

Read the peer reviews for this feature

Decisions. Decisions. The life blood of any manager. Should I do this? Or that? What about the other? What will happen? Oh, I wasn’t expecting that…

Virgin decided to install entertainment systems on its Pendolino and Voyager multiple units when it introduced them in the early 2000s, just as passengers took to iPods and brought their own entertainment with them. 

First Great Western put seat-back screens into its HSTs, just as passengers took to iPads and brought their own films with them.

Rail companies are still scrabbling to bring WiFi onto their trains, generally at the Government’s behest. Meanwhile more and more passengers are using 4G data from their mobile phones.

Government ordered electric trains before discovering their intended routes would not be wired in time. This led to it having to change its contract with the train builder to have diesel engines fitted.

If there’s a common theme in these examples, it’s that risks were not fully explored, understood or identified. These risks were not to safety or life, they were risks to investment - commercial risks. The risk of wasting money.

Of course, we can look back more easily than we can look forward. Hindsight is all-seeing. We are all prisoners of our experiences, but managers must look into the future. Sometimes (often?) that future is murky. What if the economy tanks? Or booms? What if my new trains don’t work?

RSSB publishes guidance, in the form of Taking Safe Decisions. Its title neatly summarises it. But change that title to Taking Good Decisions and substitute risks to life (safety) with risk to business/revenue/reputation (income), and it still delivers sound advice.

This crossover extends to standards. They are often blamed for increasing costs, but in reality they reduce costs when used properly. They drive standardisation, rather than bespoke solutions. They allow things to be repeated, rather than developed from scratch every time. The trick is to recognise when something is the same and when it is different.

Britain has a very safe railway. But managers and staff didn’t achieve this simply by applying standards left, right and centre - not least because applying a standard may not reduce a risk to as low as reasonably practicable (the legal test). They achieved it by looking for risks, thinking about them and mitigating them. 

You can apply the same principles to projects. What are the risks involved in installing new points on the approaches to a major London terminal in four days over Christmas? What happens if it’s too windy for cranes? Or so cold that ballast freezes in wagons? Or a key piece of kit fails? Or engineering train drivers run out of hours?

As with safety, risk is a combination of a hazard’s probability and consequence. And the different risks may be linked. You might lose two hours of crane use from high winds. Does that raise or lower the probability of drivers running out of hours? Looking backwards can help decide on the probability of an event. Looking at previous incidents can give some idea of the consequences. You need both if you’re to assess risks and act to mitigate them. Of course, you can ladle on too much mitigation and too much contingency, pushing costs upwards, and that’s something many think Network Rail is guilty of.

Reviewing an event after its delivery provides the opportunity to analyse your plans and decisions. It’s the time to decide what worked well and what didn’t, the time to decide whether there was too much mitigation or too little. Properly recorded and readily accessible, this analysis will inform future managers.

What risks apply to franchises such as East Coast, which owner Stagecoach reports is not performing in line with expectations? What mitigations sit within (or outside) its franchise agreement with Government to protect it from a falling economy? Or Network Rail’s infrastructure being unable to support the new IEP trains it will use? Or those trains (ordered by Government) not being fit? 

How has the Government assessed what risks face both itself and taxpayers? And there’s another franchising ‘what if’ that should concern the Government. What if it accepts another bid that brings an entirely new fleet of trains in place of one that’s not old enough to retire? 

Explored in more detail in RailReview Q2-2017, is it prepared for the consequences of the rolling stock finance market pushing prices up, as it realises that trains now have shorter lives? 

International Financing Review reported on Eversholt’s £400 million bond sale on July 29: “One fund manager said he was passing up the opportunity because he was worried that adding new train fleets will become a more important part of winning rail franchises than price, and the re-letting risk for older trains will increase along with credit metrics.”

There are unintended consequences aplenty in that scenario, and it demands thorough analysis and clear thinking from the Department for Transport.

Finding credible answers to these problems needs good managers with good training and education. It’s an area that is worrying some. At the National Skills Academy for Rail (NSAR), Chief Executive Neil Robertson reckons that fewer than half of rail managers working in management jobs have appropriate training. He notes that there is good training out there, but not enough.

His worries extend upwards to the skills of senior managers, particularly commercial skills. What seems absent is not the skills and experience needed to run a rail operation, but those needed to run a business - communications, people, governance, risk, marketing, productivity and commercialisation of assets. 

Robertson is keen that managers think of rail in its economic place. How does rail fit into wider transport policy? How does rail fit into wider transport networks? How does a train fit into an end-to-end journey?

There’s scope, he thinks, for developing an executive masterclass programme for senior managers. This might look at financial models and financial engineering, which he suggests are core skills in other sectors. It could look at new technology and its implementation in what is normally a very conservative industry. It could look at how to make productivity improvements.

Robertson suggests that such a course would need at least 16 attendees to make it worthwhile, but with someone from each train operator and Network Rail Route that should not be hard to achieve. 

There are shades of the old railway staff colleges in what he suggests, as well as shades of today’s military staff colleges, which mix training for specifics of an army, navy or air force officer’s career with education that encourages wider thinking beyond their service. The military also teach their people to understand the situation at least two levels above them when they’re planning their own activities. This is done specifically to allow them to seize opportunities that appear, because they know a course of action will match the wider picture.

Peter Hansford’s recent investment review for Network Rail looks at how to build confidence and reduce costs so that private money might be attracted into investing in rail infrastructure. He reports one view of the difference between working for Network Rail and for Highways England.

“A comparison was made by one consultee between dealing with Network Rail and Highways England on a specific project. The Highways England sponsor was described as consistent, empowered, motivated and supported by their organisation to effect progress. The road scheme in question was delivered by the private funder with its own contractor and to its own required timescale, and was accepted by Highways England based on an assurance package covering the standards applied and corresponding construction and test records. The rail connection by comparison, which was to be delivered by Network Rail, was beset with issues of inconsistent advice, rising costs and changing dates.”

There are too many business risks in becoming involved with NR. And many of these risks lie outside an investor’s control. 

Hansford found little clear air between NR corporate policies and standards, and this led to third-party investors being asked to pay for things beyond their remit. He also found that different parts of NR applied standards differently, which suggests that there’s no consistent standard of understanding across NR - odd given that NR has a centralised training facility. It also suggests that there’s little commercial experience within the company that can understand that their third-party investors need to generate returns for their money.

Hansford reveals some of the reasons why NR might be such a poor customer. He found that in creating its own infrastructure projects company (NRIP), NR had stripped out project management and commercial competence from the rest of the company. NR had intended to make it easier to choose between delivering projects through private companies or through its new IP creation. Instead, it created a situation in which IP was the only part of NR with any competence to deliver projects.

On standards, he finds: “Standards themselves are not necessarily the source of the issue behind third party concerns. It is more likely that the main issues are the complexity of the standards landscape and the variations and derogations process; a lack of transparency in the process for applying standards during project development; the misuse of standards to drive ‘gold plating’; and the lack of timely decisions regarding the scope of standards-related work which can lead to unplanned impacts on construction and handover.” 

As Network Rail now looks towards devolution and local teams delivering projects, it will need to think carefully about how it injects management and commercial skills into its regions. 

There’s a risk that overall costs might rise with more staff. There’s a risk that it might take more time and effort than NR and its government paymasters are prepared to expend, in order to convince private contractors that it has really changed and is now serious about them playing a part in delivering a better railway. There’s also a risk that ministers decide to cease upgrading the railway, and instead concentrate simply on maintaining and renewing today’s railway.

Robertson’s questions play into the psychology of decisions as RSSB describes them in Taking Safe Decisions (see panel). It notes a tendency for decision makers to try to avoid losses rather than make gains, and the perils of framing problems too narrowly. Decisions made by rail managers have effects beyond the railway because the railway is part of the country.

The developer that builds a new housing estate next to a railway without thinking about how those householders will travel to and fro could make poor decisions - poor because they’re selfish. The railway manager who decides to skip-stop the nearby station to speed a longer journey might not be making the best overall decision in terms of the area’s transport, even if it’s the best decision for the railway. Of course, there’s a balance between selfishness and altruism, just as there’s a balance between the costs and benefits of a safety decision.

Ministers have recently halted England’s electrification programme. They probably didn’t intend to waste the investment that’s gone into designing new overhead line equipment that brings lower whole-life costs based on widespread implementation. They probably didn’t intend to waste the money that’s gone into relearning lost skills and training a new generation of linesmen. But they have wasted this money… and they’ve created a situation that has damaged trust from rail contractors.

That said, ministers faced a difficult decision in the face of sharply rising costs. But rewind the tape five years to their announcement in 2012 of a massive programme of wiring, and ask yourself whether such a programme was credible. Even allowing for hindsight, it’s hard to resist the conclusion that ministers were asking for too much, too soon. They and their advisors cannot have credibly analysed the risks surrounding their electrification plans.

Yet as the psychology panel notes, you can over-analyse a problem by casting your boundary too wide. The opposite of narrow framing can make a problem too difficult. ‘What if’ questions can go too far. 

We can be certain that Brunel did not ask ‘what if someone wants to run 125mph trains?’ as he laid out the Great Western Main Line. What he did was survey a generally straight and flat route because that’s what was best for the locomotive technology he had at hand. What worked for him works today.

In Taking Safe Decisions, the RSSB shows a more developed version of the classic ‘plan-do-review’ or ‘observe-decide-act’ cycle of decisions. It has two loops. One contents itself with implementing change, while the other examines the safety aspects of that decision. You need only replace the two instances of the word ‘safety’ with whatever risk environment you’re considering and the cycle should work for you.

At the heart of unintended consequences is a poor appreciation of a situation and the effect that change might have. Countering them comes from having good leaders with the character, courage and competence to challenge what they see. In turn, this challenge should improve their thinking and the thinking of those around them. But it needs competence - and that comes from experience, training and education. 

Philip's article is an important and timely exploration of an issue about which I feel very strongly, in an area where - despite all that has been achieved - there is still a gap in capability and maturity across the sector. 

Making good and timely decisions requires experience and competence, which then gives people the confidence to not just make the decisions but also to seek advice and support when they are not completely sure. 

Why do I fear there is a capability gap? Well, as well as the examples that Philip highlights and the fact that we have repeat causation incidents, the ORR’s RM3 (Risk Management Maturity Model) assessments indicate that although we have pockets of excellence, that is far from widespread. 

When I became Chief Inspector of Railways, I set out a vision for the industry of "zero industry-caused fatalities on the path to zero harm". This was to be achieved through reaching the goal of excellence in Health and Safety and Asset Management. 

To help achieve this, one has to know where dutyholders are. Therefore, we developed RM3. It tells us that although there has been strong performance in recent years, there is still some way to go, and incidents such as the tragedy at Croydon and others demonstrate the need for vigilance. They also demonstrate that we are not in a position of confidence that is sustainable. And the key to resolving that is enhancing Capability and Maturity across the sector.

In ORR’s latest annual health and safety report, I identified four key issues that the industry must focus on - all of them linked through Capability, Competency and Maturity. Examples of where we have not reached the necessary level in risk management are clearly identified in Philip's article. They are: 

1. Maintaining a safe and sustainable infrastructure: For example, management of civil assets is a high priority for ORR. This is because of the age of the portfolio and its susceptibility to rapid deterioration in adverse weather. Initiating failure mechanisms are often difficult or impossible to detect by visual inspection, and some of the work that was planned has been deferred because of funding constraints. This puts added pressure on front line staff to make the right decisions.

2. Culture and occupational health: Although we see areas of excellent practice, the sector still has some way to go in developing its overall safety culture and management of health to achieve widespread excellence. Evidence shows that focusing on improving the health of the workforce not only leads to a more engaged workforce, but also to a stronger culture and a more efficient business. A renewed and greater focus on mental health is particularly important.

3. Managing change well: As well as growth continuing in some parts of the sector, during the past year a number of new franchises have been awarded that will lead to an increase in the number of services, as well as new rolling stock. This increases the inherent risk, which duty holders need to co-operate to mitigate. Again, maturity in managers is critical here. One way of achieving this is through the introduction of new technology and working practices. However, it is imperative that these changes are managed well. Sometimes they have not been, and that is why we still believe there is a capability and maturity gap across the sector. 

4. Safety by Design ‘without gold plating’: As new strategic assets are introduced - whether a major infrastructure project, a rolling stock project or smaller enhancements - it is vital that the critical principles of excellent Safety by Design are employed by the sector. Philip identifies some instances where this has not been the case. Often standards are used as an excuse for a lack of managing risk in an effective and efficient way. To help the sector, we have refreshed our strategic risk chapter on the subject and included it in our Principles and Guidance documents.

So, how can we bridge the gap and achieve maturity? 

1. Stronger leadership throughout organisations as development of managers across the industry is required. Devolution will help - but at the right pace, ensuring capability and maturity is built and maintained. 

2. Structured continuous improvement using RM3 route-wide and across the train/track divide. Sharing good practice between TOCs and NR - as we saw happen in the Wessex Alliance.

3. Deliver the Industry Health and Safety strategy, including the work on Health and Wellbeing. Focus in particular on mental health, as that will lead to improvements in culture. The industry must assess its capability to deliver a high-quality health and safety strategy and (where necessary) plug any gaps that exist.  

4. Learn to manage risk effectively, challenge the status quo, and innovate. Ensure all managers and engineers read Taking Safe Decisions and drive peer reviews . Also, they all need to read, digest, understand and use our Principles and Guidance documents. 

5. Improve planning and collaboration to ensure all work is done as effectively as possible. Devolution should help, but it is important to understand there are trade-offs that need to be managed.

6. Improve engagement with the workforce, so that we are all pulling in the same direction. We cannot leave people isolated. They have fears and are unsure about change, so the industry must engage with them to help them take the next vital steps. 

If we focus on these, each of us can make a real impact in terms of improving capability and maturity, and helping our industry become world-class  - as well as ensuring the railway remains a vital component of all our lives, even for those who do not use it!

 

One of the hallmarks of a good leader is the way they
manage uncertainty, see the big picture and communicate a clear vision, so it should be no surprise that the key to making a good decision lies in leadership.  

What’s often forgotten is that increasingly, this leadership doesn’t just come from the CEO or members of a dedicated leadership team. Leadership ability has to be nurtured in everyone throughout an organisation, so that decisions can be made confidently and efficiently - ‘no decision’ is usually a bad decision. We need to make sure we have a good supply of up-and-coming leaders for tomorrow’s railway.

Does this happen on Britain’s railways today? Probably not enough. How often do you hear that the retirement of another veteran has led to a gaping hole in an organisation’s capability or a loss of corporate memory? So as much as we need people who understand tomorrow’s problems and the outside world, we also need to make sure we retain and build on today’s talent in the bread-and-butter of running a railway.

Philip Haigh is absolutely right, however: the key to getting to grips with this uncertainty is a systematic approach to understanding the risk, and horizon scanning. Consider how industry’s sustained focus on some types of safety risk has paid off. Signals passed at danger, train accident risk and level crossings are examples where the ‘Taking Safe Decisions’ model has been applied to good effect with tangible, visible and quantifiable results. Risk has either been reduced or is managed more effectively to avoid incidents.  

As important as addressing genuine risk is the need to avoid investing time, effort and money where it isn’t needed. Again, this is where the ‘Taking Safe Decisions’ model can help, as it steers an organisation to consider responses that are proportionate to the issues at stake. This is critical to ensuring the railway retains good safety performance and reliability while still reducing costs.

The rail industry’s Data and Risk Strategy is designed to take us to the next level in response-time. The digital revolution has led to a proliferation of data, and is producing the capabilities and tools to turn it into actionable intelligence for the rail industry. 

In the future, companies could be analysing real-time information in a ‘safety control centre’, acting on alarms with urgent responses in the field. Systems will also support rapid tactical analysis of similar combinations of weaknesses in safety defences, by rapidly and intelligently filtering aggregated risk, asset and safety control data to quickly target a broader response. They will also support the robust analysis of investment options to strengthen safety where necessary, rapidly developing robust investment cases based on clear analysis of the balance between cost, performance and safety to support timely management decisions. 

While the ‘Taking Safe Decisions’ model can also be adapted to consider other types of risk, it is important to remember that safety is a business risk. A poorly managed risk about safety or sustainability, or reliability or reputation, will ultimately manifest itself as a cost in pounds sterling and potentially jeopardise the overall ability to do business. And it’s a safe bet that an organisation which does safety well probably runs its overall business well, with a close eye on its people, culture, revenue, relationships, reputation and future potential.  

It’s also true that risks are rarely mitigated or managed via blind adherence to standards. Legislation is not prescriptive, and the state does not specify requirements in detail. Instead, organisations need to do more thinking themselves, to properly consider how they will meet their obligations. 

Standards help, as they provide industry-agreed best practice and avoid the need to reinvent the wheel every time, but careful thought is still required. There are advantages on offer - there is more flexibility which encourages people to think for themselves, moving away from a box-ticking mentality and taking full ownership of their risks. This is something which ORR is very much pushing for.  

RSSB, with its expertise in this area, continues to work hard and is always available to help the industry to better understand and manage the complexity of the regulatory landscape, and the use of standards as the industry organisations take decisions. 

We cannot pretend that the regulatory world is simple, or just hope it to be so to solve all their problems. The industry needs to have the capability to work with this inherent complexity because, although difficult, it also offers greater flexibility, choice and benefits than a simple rigid regime, if handled correctly. Better understanding in this area, including early engagement with RSSB, offers great opportunities to the industry - including proportionate and correct application of standards. 

Correct application of standards to discharge legal obligations also means recognising where industry and its supply chain has choices that can be exercised to design and implement optimal and proportionate solutions, while still being compliant with the law. 

It does take financial and business acumen to do this, though, and the Hansford Review is likely to corroborate the instincts of many about what it’s like to do business with the railways. However, we do need to reinforce these business and strategic planning competences across the whole supply chain and throughout the railway as a whole, not just in one part.  

It is particularly important that with Brexit, which brings extra uncertainty and issues of its own, the railway is truly open for business and gets past the mutual distrust that can characterise the railway family, and which seems to prompt an industry review at every turn. If we can show we understand business better, maybe others will strive to understand the railway better?

Philip’s article also reveals the importance of horizon scanning. This is an area where our members and the ORR have asked us to put more emphasis, to use our data, research and analytical capabilities to provide more thought leadership on the issues that are likely to have an impact on rail. Some of this we’ve always done, but we can afford to be bolder and provide a more informed interpretation of what this all means to them, and you’ll see more of that from this autumn onwards.

What I would add is that sound decision-making and risk management is also aided by the industry working together, and sharing both the burden and the fruits of the effort involved. At RSSB we strive to help in this area, providing the thinking space for industry to meet and agree shared approaches to issues, supported by our own experts and access to accumulated data and knowledge.  

Twenty-first century risk management isn’t about one person or one process, it’s about everyone having the right approach and competence to manage risk with confidence. By supporting us and the work we do, they will ultimately reap a reward that shows up on their balance sheets.