4.1.1 Introduction

Making a decision is often difficult because of the uncertainties involved and the risks these uncertainties entail. A balance needs to be struck between different alternatives and the corresponding consequences. The decision therefore depends in part on how a choice problem is defined and the value that is attached to the pros and cons of an alternative. However, this involves a lot of uncertainty, as people can never be completely sure of the exact consequences of the chosen course of action [1].

Much research on decision-making has already been carried out in different disciplines. Various models and theories can be found in the literature that describe decision-making under conditions of uncertainty and which attempt to explain the phenomena observed. The first theory, developed as early as the seventeenth century, is the “expected value theory” (see also Chapter 2). According to this theory, people take decisions by maximizing the expected value.

However, the St. Petersburg paradox – which is a paradox related to probability and decision theory – made it clear that the expected value theory would not hold in real situations. The paradox is based on a particular (theoretical) lottery game that leads to a random variable with an infinite expected value (i.e., infinite expected payoff) but that nevertheless seems to be worth only a very small amount to the participants. The St. Petersburg paradox is a situation where a naïve decision criterion, which takes only the expected value into account, predicts a course of action that no actual person would be willing to take (see also Section 4.1.2). The St. Petersburg paradox therefore made a more accurate model necessary, and Bernoulli developed a new theory, the “expected utility theory.” This theory states that people attempt to maximize not the expected value, but the expected utility, when making decisions (see also Chapters 3, 7, and 8). People assess the utility of each outcome based on probabilities and then choose the alternative with the highest sum of weighted outcomes.

Kahneman and Tversky then developed a theory that took into account the human factor: the “prospect theory.” This theory was very successful as it included the psychological aspects of human behavior. In this theory, a choice problem is defined relative to a reference point. Depending on coding in terms of gains and losses, people will show more risk-averse or risk-seeking behavior [2–5].

People are constantly taking decisions, consciously or unconsciously. It is therefore not surprising that the subject of decision-making is studied in various disciplines, from mathematics and statistics to economy and political science, to sociology and psychology.

4.1.2 Expected Utility Theory

As described in the introduction, the first universally applicable decision-making theory was the “expected value theory,” developed as early as the seventeenth century. According to this theory, people take decisions based on maximization of the expected (monetary) value. However, this theory was repudiated by the St. Petersburg paradox. In the St. Petersburg paradox, a coin is tossed until “heads” appears. If “heads” appears on the first toss, the casino pays €1, otherwise it doubles the payout each time “heads” appears. What price would you be prepared to pay to enter this game? This paradox describes a gamble with an infinite expected value. Even so, most people intuitively feel that they should not pay a large price to take part in the game [3, 6].

To solve the St. Petersburg paradox, Bernoulli developed a new theory. He suggested that people want to maximize not the expected value, but the expected utility. As a result, the utility of wealth is not linear, but concave. After all, an increase in wealth of €1000 is worth more if the initial wealth is lower (e.g., from €0 to €1000) than if it is higher (e.g., from €10 000 to €11 000). This theory is called the expected utility theory in the literature. It is a theory about decision-making under conditions of risk in which each alternative results in a set of possible outcomes and in which the probability of each outcome is known. Individuals attempt to maximize the expected utility in their risky choices. They calculate the utility of each outcome using probabilities and choose the alternative with the highest sum of weighted outcomes. The attitude of an individual to risk is defined by the form of a utility function. For a risk-averse individual, the function is concave; for a risk-neutral individual, the function is linear; and for a risk-seeking individual, the function is convex. Given a choice between a certain outcome with a utility y and a gamble with the same utility y, a risk-averse individual will choose a certain outcome, a risk-seeking individual the gamble, and a risk-neutral individual will treat the two outcomes equally [3–5, 7–9].

4.1.3 Prospect Theory

The expected utility theory has been considered for a long time the most applicable method but, despite its strengths, it has encountered several problems as a descriptive model for decision-making under conditions of risk and uncertainty. After all, it requires that the decision-maker has access to all the information describing the whole of the situation. Clearly, this information requirement is far too rigorous for most practical applications, in which the probabilities cannot be calculated exactly, or the decision-maker does not yet know what he or she wants, or the series of alternatives is not fully determined, and so on. In addition, there is plenty of experimental evidence to suggest that individuals often fail to behave in the manner defined in the expected utility theory. In fact, the choices made by individuals consistently deviate from those predicted by the model, as is made clear in the experiments of Allais and Ellsberg.¹ The so-called Allais paradox shows that individuals are sensitive to differences in probabilities. Experiments show that an individual's willingness to choose an uncertain outcome depends not only on the level of the uncertainty, but also on the source. People show dependence on a source when they are prepared to choose a proposition from source A but not the same proposition from source B. Regarding the so-called Ellsberg paradox, there are different versions of Ellsberg's experiment. In one version there are two urns, one containing 50 black and 50 red balls, and the other containing 100 balls about which it is only known that they are either red or black. People must choose an urn and a color, then draw a ball from the chosen urn. If the ball matches the color chosen, the subject wins a prize. Ellsberg noted that people display a strong preference for the urn with an equal number of red and black balls, despite the fact that economic analysis suggests that there is no reason to prefer one urn or the other. Ellsberg's classic study therefore shows that people attach a higher value to bets with known probabilities (risk) than to bets with unknown probabilities (uncertainty). This preference is called “ambiguity aversion.” The Ellsberg experiment shows that it is possible that decision-makers will not follow the usual rules of probability if they cannot act based on subjective probability. As a result, in such situations the theory of expected utility does not accurately predict behavior. For a more positive appreciation of expected utility theory see Chapter 7. An alternative theory was therefore required to describe the observed empirical deviations [3–5, 7–20].

Kahneman and Tversky's [4] prospect theory is considered an alternative to the expected utility theory and one of the principal theories for decision-making under conditions of risk. According to this theory, individuals are more likely to assess outcomes based on change from a reference point than on an intrinsic value. After all, people tend to think in terms of losses and gains rather than intrinsic values and therefore make choices based on changes relative to a certain reference point. The reference point is often, but not always, the status quo. Assuming that the reference point is zero, gains are represented by positive outcomes and losses by negative outcomes. The concept of a reference point means that people deal with losses differently from gains. Because people code outcomes in terms of a reference point and deal with losses and gains differently, the definition of this reference point or construction of the choice problem is crucial. How people approach the problem – i.e., in terms of losses or gains – affects the preferences independently of the mathematical equality between the two choice problems. Most decision problems take the form of a choice between maintaining the status quo and accepting an alternative, which may be more advantageous in some respects and less advantageous in others. The advantages of an outcome are then assessed as gains and the disadvantages as losses. Individuals usually give more weight to losses than to comparable gains and display more risk-averse behavior in the case of gains and more risk-seeking behavior in the case of losses [2–5, 10, 21–28].

According to prospect theory, each individual attempts to maximize the utility function, defined not in absolute terms but in terms of losses and gains relative to a reference point. This function is usually concave for gains and convex for losses, reflecting the risk-averse behavior for gains and risk-seeking behavior for losses, as shown in Figure 4.1 [2, 3, 8, 10, 21, 24, 27–30].

Risk-averse behavior for gains is seen in the fact that people choose certain gains rather than uncertain, but larger, gains. In Figure 4.2, a certain gain is shown as CE and the uncertain, larger, gain as x*. Due to risk-averse behavior, the expected value of the uncertain gain E[U(x)] is lower than the actual utility for this gain U(x*). The utility function of a risk-averse individual is therefore concave. Risk-seeking behavior in the case of losses, on the other hand, is expressed by the fact that people choose uncertain, higher losses rather than certain, but lower losses. Finally, in the case of risk-neutral behavior, the expected value, E[U(x)], will be equal to the actual utility U(x*), and the utility function will be linear. These findings can be readily applied to operational safety by inserting the safety utility function S_u in the place of the utility function (see also Figure 3.6).

These findings show that the preference for prospects relating to losses only are the mirror image of preference for prospects relating to gains only. Kahneman and Tversky [4] call this the “reflection effect” around the reference point. This means that the sensitivity to change decreases with increasing distance from the reference point [2, 3, 8, 10, 21, 24, 27–30].

An aversion to risk is reflected in the observed behavior, i.e., people are more sensitive to losses than to gains. The utility function for losses is therefore steeper than that for gains, as shown in Figure 4.3. A loss of €5000 results in a value of −€4000, whereas a gain of €5000 only results in a value of €3000. In absolute terms, therefore, people attach a higher value to a loss than to an equivalent gain. This means that a reduction in loss has a much higher value than an increase in gain of the same amount, so that people express more risk-seeking behavior in the case of losses and more risk-averse behavior in the case of gains. The convex curve for losses and concave curve for gains therefore give a typical utility function an S-form [2, 3, 8, 10, 21, 24, 27–30].

People treat gains differently from losses based on two aspects. The first of these is the reflection effect, as discussed earlier, and the second is “loss aversion.” Loss aversion explains why losses weigh more heavily than gains. It implies that people prefer the status quo, or other reference point, to a 50/50 chance of positive and negative alternatives with the same absolute value. The negative utility of giving up a good is therefore experienced as greater than the utility of acquiring a good, so that people often choose the status quo rather than a change. This phenomenon reflects the observed greater sensitivity to losses than to gains. The result is a utility function that is steeper for losses than for gains. One implication of loss aversion is that individuals have a strong tendency to remain in the status quo, as the disadvantages of leaving the status quo weigh more heavily than the advantages. Loss aversion also implies that people place a higher value on a good that they own than on a similar good that they do not own. This overvaluing of property is called the “endowment effect.” The process of acquiring a good increases its value. This even applies to trivial goods such as sweets or coffee mugs. One consequence of this phenomenon is that people often ask for more to give up a good than they are prepared to pay for it. This means that the selling price is always higher than the buying price, as the highest price a buyer is prepared to pay to acquire a good will be lower than the minimum compensation required to give up the same good [2, 4, 5, 10, 21, 24, 26–28, 33–36]. Translated into safety language, this means that safety management is not inclined to change existing company safety measures and policies, even if the new safety measures and policies would prove to be better at the same price. Therefore, a minimum safety increase premium (see Section 4.2.5) may be needed to convince safety management to change an existing safety situation.

In addition to the reflection effect, loss aversion, and the endowment effect, the prospect theory also makes use of other effects to describe and explain behavior during decision-making processes. First of all, it is possible to deduce from a number of empirical observations that individuals weigh certain outcomes more heavily than possible outcomes. This is called the “certainty effect.” People also weigh small probabilities more heavily, and attach too little weight to average and high probabilities. As a result, highly probable but uncertain outcomes are often treated as if they were certain. This effect is called the “pseudo-certainty effect.” Consequently, changes in probability that approach 0 or 1 have a larger impact on preferences than comparable changes in the middle of the range of probability. This effect can be clarified using the following example: during a hypothetical game of Russian roulette, people are prepared to pay more to reduce the number of bullets in the revolver from one to zero than from four to three. There is also the “immediacy effect,” which refers to a preference for outcomes that are experienced immediately. Finally, prospect theory also describes a “magnitude effect.” This effect refers to the following pattern: people are risk-seeking in the case of small gains and become strongly risk-averse as the size of the gain increases, and people are risk-averse in the case of very small losses and become more risk-seeking as the size of the losses increases [5, 8, 10, 21, 24, 25, 27].

4.1.4 Bayesian Decision Theory

The Bayesian decision theory can be seen as the newest theory, further advancing insights beyond prospect theory, and aims to resolve the consistency problems with, on the one hand, predictive risk analysis and expected utility theory and, on the other, common-sense considerations of risk acceptability in some well-constructed counter-examples in experiments like the ones by Allais and Ellsberg which are typically brought forth by the behavioral economists. This neo-Bernoullian decision theory is a direct reaction to Kahneman and Tversky's prospect theory [27], which was felt to put too high a premium on the sterile empiricism of hypothetical betting experiments, while at the same time failing to appeal to the need for compelling and rational first principles. The Bayesian decision theory differs from the expected utility theory in that an alternative position measure which captures the worst-case, most likely, and best-case scenarios is maximized, rather than the traditional criterion of choice where the expected values are maximized.

It can be demonstrated that this simple adjustment of the criterion of choice accommodates (non-trivially) the Allais paradox and the common-sense observation that type II events are more risky than type I events, as well as (very trivially, as the Ellsberg paradox is arguably not that paradoxical) the Ellsberg paradox (see Sections 7.3 and 7.4, respectively). Moreover, it can be shown that the proposed alternative criterion of choice relative to the traditional criterion of choice leads to a more realistic estimation of hypothetical benefits of type II risk barriers (see Section 8.12).

4.1.5 Risk and Uncertainty

The world that we live in is a world full of uncertainties in which, in most cases, we are unable to predict future events. Nevertheless, people are forced to make predictions given that suitable management responses are required when facing uncertainties, particularly in the field of operational safety. To explain how people deal with uncertainty when making a choice between different alternatives, use has traditionally been made of either formal models or rational analyses. Two types of models are used. The first of these is used mainly in economics and in research into decision-making: a numerical value is assigned to each alternative and the choice characterized by maximization of this value. In doing this, people mainly make use of normative models, such as the expected utility theory, or descriptive models, such as the prospect theory. The second type of model is usually used in law and politics. This approach identifies different reasons and arguments for why a certain decision should be taken. When making a decision, people weigh up the reasons for and the reasons against a certain alternative. A decision therefore depends in part on the value attached to the pros and cons of a particular alternative [1, 37].

A distinction should be made between “uncertainty” and “(negative) risk.” The difference between risk and uncertainty is that, in the case of uncertainty, the probability is not fully known. Risk is characterized by an objective probability distribution, while uncertainty bears no relation to statistical analysis [5, 38, 39].

In the modern world, (negative) risk takes two fundamental forms. Risk as a feeling refers to the quick, instinctive, and intuitive response of an individual to danger. Risk as analysis results in logic, reasoning, and scientific deliberation, as applied in risk management. People generally make decisions involving risk by constructing qualitative arguments that support their choice. During a decision-making process, a distinction is made between risky and risk-free choices. Risky choices are made with no prior knowledge of the consequences. As the consequences of such actions depend on uncertainties, this choice can also be regarded as a kind of gamble that results in certain outcomes with varying probabilities. However, the same choice can be described in different ways. For example, the possible outcomes of a gamble can be described as gains and losses compared with the status quo or the initial position. An example of decision-making involving risk is the acceptability of a gamble that results in a certain monetary outcome with a specific chance. A typical risk-free decision concerns the acceptability of a transaction in which a good or service is exchanged for money or labor. Most people will choose certainty in preference to a gamble, even though a gamble has, mathematically speaking, a higher expected value. This preference for certainty is an example of risk-averse behavior. As indicated before, a general preference for certainty rather than a gamble with a higher expected value is called risk aversion, and rejection of certainty for a gamble with the same or a lower expected value is called risk-seeking behavior. Furthermore, as also previously mentioned, people usually display risk-averse behavior when faced with improbable gains and risk-seeking behavior when faced with improbable losses [4, 38–41].

In addition to decision-making under conditions of risk, decision-making under conditions of uncertainty is also possible. Uncertainty describes a situation in which the decision-maker does not have access to any required statistical information. Various definitions of uncertainty are given in the literature. Whichever definition is used, uncertainty is not static, due to the dependence on knowledge. For example, if the amount of available information increases, the uncertainty will be reduced (e.g., going from domain B toward domain D in Figure 2.5). The term uncertainty is mainly used to describe the uncertainty resulting from the consequences of actions that are unknown because of their dependence on future events. This is often called “external uncertainty,” as it concerns the uncertainty of ambient conditions beyond the control of the decision-maker. Internal uncertainty refers to uncertainties in the preferences of the decision-maker, the definition of the problem, and the vagueness of the information [38, 42–50].

There are in fact two types of uncertainty – objective and subjective. Objective uncertainty relates to the information about the probabilities, whereas subjective uncertainty relates to the attitude of the decision-maker. There are two aspects with respect to this attitude of decision-makers: their attitude to the gain and their attitude to the negative risk. The attitude of a person to risk is traditionally – in accordance with expected utility theory – defined in terms of marginal utility or the form of the utility function. If a decision-maker is not risk-neutral, then the subjective and objective probabilities will not be equal [5, 49].

Decision-making under conditions of uncertainty takes place either if the prior information is incomplete or if the outcomes of the decisions are unclear. The best strategy for dealing with uncertainty in decision-making is to reduce or completely remove this uncertainty. Uncertainty can be reduced by collecting more information before making a decision or by delaying a decision. If no further information is available, uncertainty can be reduced by extrapolating the available information. Statistical techniques can be used to predict the future based on information relating to current or past events. Another technique is to form assumptions. Assumptions enable experienced decision-makers to take quick and efficient action within their domain of expertise, even if there is a lack of information. If it is considered to be unfeasible or overly expensive to reduce the uncertainty, this uncertainty can be acknowledged in two ways: by taking it into account when selecting an alternative, or by preparing to avoid or face the possible risk involved [42, 46, 48, 50].

If a decision is to be made under conditions of uncertainty, use can be made of various decision strategies, including MaxMin strategy, MaxMax strategy, and the Hurwicz criterion strategy. The choice of model depends on the attitude of the decision-maker. Three different attitudes are described in the literature: pessimistic, optimistic, and neutral. In the case of a pessimistic attitude, the decision-maker only considers the worst case for each alternative. He therefore makes use of the MaxMin strategy, and the alternative with the highest gain in the worst case will be selected. In the case of an optimistic attitude, decision-makers only consider the best case for each alternative. They therefore select the alternative with the highest gain in the best case, using the so-called MaxMax strategy (not to be confused with the so-called “Maxmax hypothetical benefits” – see later in this chapter). The third type is the neutral attitude. In this case, the decision-maker considers each case in the same way and the evaluation value of each alternative is determined by the general conditions. A combination of an optimistic and pessimistic attitude is called the Hurwicz method [45, 47, 49].

It should be noted that the uncertainties involved in making decisions increase in size and impact if decisions need to be made concerning the risks related to type II risks. After all, high-impact, low-probability (HILP) events are characterized by low probabilities and large, extensive, and possibly irreversible consequences. Type II risks are not always well understood, with the result that people do not always know how to deal with them. It is not possible to increase knowledge through experimentation, given that the risks are effectively irreversible in a normal time frame. The classic theories, based on expected utility, therefore do not always work and results should be interpreted with great caution, as the models tend to underestimate events with low probabilities [46, 51], as is demonstrated in Section 7.5.

4.1.6 Making a Choice Out of a Set of Options

When making a decision, a choice usually needs to be made from a set of possible options. This choice is not made randomly. An attempt is made to make a choice that provides the best answer to a number of criteria: the optimum choice. Each choice results in a gain of a certain value, so that the choice is selected with the largest gain. However, in most cases, the gains resulting from a choice are affected by variables of unknown value. It is traditional to assume that, if a rational choice needs to be made between two alternatives that involve uncertainties, the uncertainty is described using probability and the different alternatives are ordered based on the expected utility of the consequences of these alternatives. Selection of one alternative is therefore based on the probability and potential value of a possible outcome [47, 52, 53].

There are two phases involved in making a choice. The first phase involves various mental operations that simplify the choice problem by transforming the representation of outcomes and probabilities. Coding involves the identification of the reference point and the framing of outcomes as deviations from this reference point, and this affects orientation toward risk. After all, a difference between two alternatives will always have a larger impact if it is seen as a difference between two disadvantages rather than a difference between two advantages. The decision can therefore be made to allow the disadvantages of a deviation to weigh more heavily than the advantages. In addition, common elements to the various alternatives or irrelevant alternatives are also often eliminated. This “isolation effect” can result in different preferences, as there are different ways of separating prospects into shared and distinctive elements. This can result in a reversal in preferences and inconsistency. The second phase is the evaluation phase [5, 36].

The traditional utility function assumes that an individual has a well-organized and stable system of preferences and good calculation skills. However, such an assumption is unrealistic in many contexts. In response to this problem, Simon [54] developed the theory of bounded rationality. This implies that, due to the expense and impracticalities involved in choosing between all possible alternatives to achieve the optimum choice, people usually look for the first satisfactory alternative that meets a set of predetermined objectives. The implication is therefore that human behavior should be modeled as satisfying rather than optimizing. Such an approach has several appealing qualities, as working with objectives is, in most cases, very natural [47, 54, 55].

Evaluation of the outcomes is susceptible to framing effects due to the non-linear utility function and people's tendency to compare outcomes with a reference point. The decision frame used to analyze a decision refers to the perception of the decision-maker regarding a possible outcome of a risky decision in terms of gains and losses. Whether or not a certain outcome is seen as a loss or a gain depends on the reference point used to evaluate possible outcomes. The framing effect is seen whenever the same outcome can be considered a loss or a gain, depending on the reference point used. For example, if a company is faced with an accident cost of €5000, which was expected to be €10 000, is this experienced as a loss or a gain? The answer depends, for example, on whether the previous accident cost or the expected value is used as a reference point. Whether or not a decision is considered in terms of a loss or a gain is very important, because people display risk-seeking behavior when faced with losses and more risk-averse behavior when faced with gains [4, 8, 56].

It is therefore clear that emotions play an important role in social and economic decision-making. Individuals, including people who need to make decisions on safety budgets – such as safety managers and middle and top managers – evaluate alternatives subjectively and emotions influence these evaluations. People generally try to control these emotions and to anticipate the emotional impact on future decisions, as emotions can affect such decisions. The impact of emotions is of particular importance when assigning a value to different perspectives [8, 57].

4.1.7 Impact of Affect and Emotion in the Process of Making a Choice between Alternatives

Traditional economic theory assumes that most decision-making involves the rational maximization of the expected utility. Such an approach assumes that people have access to unlimited knowledge, time, and information-processing skills. In the 1970s and 1980s, researchers identified several phenomena that systematically violated the normative principles of economic theory. In the 1990s, emotions were shown to play a significant role in various forms of decision-making, in particular concerning decisions that involved a high level of risk and uncertainty [40, 58–60].

According to Epstein and Pacini [61], people understand reality through two interactive, parallel processing systems. The rational system is a deliberative, analytical system that functions using established rules of logic and evidence (such as the prospect theory). This system makes it possible for individuals to consciously seek knowledge, develop ideas, and analyze. On the other hand, the experiential, emotional system codes reality in images, metaphors, and narratives to which affective feelings are attached. This system enables individuals to learn from experience without consciously paying attention. Individuals differ in the extent to which the rational and experiential systems influence their decision-making. The balance between these two processes is influenced by various factors, such as age and cognitive load, both of which result in a greater dependence on affect. By affect, the “faint whisper of emotion” that influences decisions directly is meant, and is not simply an answer to a prior analytical evaluation [41, 60, 62].

People therefore base their judgment on a certain activity, not just on what they think, but also on what they feel. If they have a good feeling about a certain activity, they assess the risk as low and the benefit as high. However, if they do not have a good feeling, they will judge the risk as high and the benefit as low. This is called “affect heuristic” in the literature. If the consequences are highly affective, as in the case of the lottery or cancer, there is little variation. For example, research by Loewenstein and Prelec [8] showed that people expressed the same feelings regarding winning the lottery whether the chance was 1 in 10 million or 1 in 10 000 [41, 59, 60].

In any case, it is clear that emotions, which can be interpreted and expressed as moral principles, should be much more considered in risk indexing and risk calculations than is the case today. Section 4.10.4 therefore suggests an approach to calculate risks, where both rational and moral factors are taken into account.

4.1.8 Influence of Regret and Disappointment on Decision-making

People always wish that they had made a different decision if the decision they made turns out to have negative consequences. This feeling is even stronger if it turns out that the alternative would have resulted in a more favorable outcome. In such situations, people experience a feeling of regret. Regret is a psychological response to the making of a wrong decision. A “wrong” decision is defined based on the actual outcome and not on the information available at the moment the decision was made. Regret can result from comparison of an outcome with an outcome that would have resulted from making a different decision. Regret therefore has much in common with opportunity cost (see Chapter 5).

Regret can affect people in two ways. First of all, it can lead people to try to undo the consequences of their regretted choice after the decision has been made. Second, if they anticipate the regret they would later feel, it can influence the choice they make before the decision is taken. A new decision-making model was developed based on this anticipatory aspect of regret – the “regret theory.” Whereas classical theories assume that the expected utility of a choice depends only on the possible pain or pleasure associated with the outcome of that choice, in regret theory utility also depends on the feelings caused by the outcome of the rejected choices. Regret theory is based on two fundamental assumptions. The first is that people compare the real outcome with the outcome that would have resulted from making a different choice. As result of this, people experience certain feelings: regret, if the choice that they did not make would have resulted in a more favorable outcome; and pleasure, if the choice made has produced the best possible outcome. The second assumption of the regret theory is that the emotional consequences of the decision are anticipated and taken into account when making that decision. Different experiments have shown that such behavior results in a more risk-averse attitude. However, this is not always the case. Although most people do their best to avoid regret, this does not only result in more risk-averse behavior, but can also lead people to display more risk-seeking behavior. An aversion to regret can therefore result in choosing an outcome with the lowest (negative) risk as well as in choosing an outcome with the highest (negative) risk. Experiencing regret and disappointment also has another consequence, which is that avoiding feedback so as not to experience regret and disappointment means that people do not learn from their experiences [3, 13, 59, 63].

As well as regret and pleasure, people can also experience disappointment when making a choice between alternatives. Disappointment is a psychological response to an outcome that does not correspond to expectations. When people make a decision, they can experience these feelings when comparing uncertain alternatives. However, it is not always possible to compare the outcome of a chosen alternative and the outcome of an alternative that was not chosen. Imagine that a choice needs to be made between a certain alternative and an uncertain one. If an alternative is chosen with outcome characteristics with some probability, it is always clear what the result of the other (certain) alternative would be. However, if the certain alternative is chosen, it is not always possible to determine whether this choice resulted in a more favorable outcome or not, because one does not know whether the uncertain alternative would have been realized or not [3, 13, 59, 63].

It is possible to translate the principle of regret theory into industrial practice by using expected hypothetical benefits (see also Section 4.2.4) to aid decision-making. To this end, later in this book, expected hypothetical benefits are explained in greater depth and they are used in cost-benefit analysis (see Chapter 5) and cost-effectiveness analysis (see Chapter 6) approaches for decision-making purposes.

4.1.9 Impact of Intuition on Decision-making

The accuracy of decision-making is often inversely proportional to the speed with which decisions need to be made. To explain the fact that people are able to make high-quality decisions relatively quickly, most researchers focus on intuition. Individuals mainly make use of intuition when they are faced with severe time constraints. After all, intuition is based on our innate ability to synthesize information rapidly and effectively and could therefore be essential in successfully solving complex tasks in a short space of time. However, intuitively making decisions does not always result in accurate decisions, as applying intuition only results in speed, sometimes at the expense of accuracy [62, 64].

4.1.10 Other Influences while Making Decisions

In addition to emotions, there are also other factors that influence decision-making. The knowledge available within the decision context also determines an individual's behavior when choosing between alternatives. Research shows that individuals who are not experts are typically overconfident. They overestimate the quality of their abilities and knowledge and perceive extreme probabilities as not so extreme. Experts and more qualified people, on the other hand, are more sensitive to the risk associated with a hypothetical gamble and display more risk-averse behavior, as shown in the research of Donkers et al. [65]. Second, age also has an impact on the decision-making process. The older an individual, the more experience they have and the more capable they are of curtailing overconfidence and therefore responding like an expert. Older people have a more accurate idea of their knowledge and the limits of that knowledge [66, 67].

Finally, gender also plays a large role in decision-making. Many studies have highlighted the fact that men are more risk-seeking than women. The reasons for this difference in approach to risk have already been investigated in various research areas. They can be caused by nature or nurture, or a combination of the two. For example, (young) boys are expected to take risks when participating in competitive sports, whereas (young) girls are often encouraged to be careful. The high-risk choices that men make may therefore be the result of the way in which they were raised by their parents. The same applies to women's risk aversion. Another possible explanation for gender differences is that the way in which risk is experienced relates to the cognitive and non-cognitive differences between men and women. It should be pointed out that women who acquire more competences, become more confident or obtain more knowledge show increased risk-seeking behavior when making decisions. However, such factors have an opposite effect on men, who display more risk-averse behavior with increasing expertise and confidence. Finally, the framing of a decision problem strongly influences the way in which a man makes a decision, but not a woman [14, 66, 68, 69].

4.2.1 Introduction

In the previous section, the way in which people make decisions and choices, and all the accompanying influencing psychological principles, was discussed. It is obvious that decision theory and making choices under uncertainty are not at all easy to model. The very nature of operational safety management, safety being defined as “a dynamic non-event,” makes it very hard to develop a decision-supporting model. Nonetheless, safety managers need to make such decisions, based on their emotions, their intuition, and the available information and its accompanying uncertainty and/or variability. Making decisions to deal with operational safety should be as accurate as feasible, rational, cost-effective, simple yet not over-simplified, no-nonsense and pragmatic, and, most importantly, as effective as possible (so that there are as many non-events as possible). To this end, a number of possible decision-making approaches may be worked out and will be elaborated upon and explained in the remainder of this book. The decision process should lead to adequate and optimized (according to the company's safety management characteristics) risk treatment. The concept of “risk treatment” should be explained at this point. There are several possible ways to treat risks:

1. 1. Risk treatment option 1: risk reduction
   1. a. Risk avoidance
   2. b. Risk control.
2. 2. Risk treatment option 2: risk acceptance
   1. a. Risk retention
   2. b. Risk transfer.

Organizations basically have two main options to deal with risks: they can either accept the risks, or they can reduce the risks. Risk reduction options involve technological, organizational/procedural, and human factor prevention and mitigation measures in order to decrease the risk level. Risk acceptance options, on the other hand, encompass measures that reduce the financial impact of the risks on the organization. There are two sub-options available within each of the two main options [70]. For risk reduction these are risk avoidance and risk control, whereas for risk acceptance, these are risk retention and risk transfer.

4.2.2 Risk Treatment Option 1: Risk Reduction

Risk avoidance and risk control can be achieved in an optimal way by inherent safety or design-based safety. There are five principles of design-based safety. The possible implementation of these five principles is explained for the case of the chemical industry, illustrated in Figure 4.4.

As explained by Meyer and Reniers [73], techniques of risk reduction aim to minimize the likelihood of occurrence of an unwanted event and/or the severity of potential losses as a result of the event, or aim to make the likelihood or outcome more predictable. They are applied to existing processes and situations and can be listed as:

• Substitution – by replacing substances and procedures by less hazardous ones, by improving construction work, and so on. Care should be taken that there is not simply a replacement of risk.
• Elimination of risk exposure – this consists in not creating or completely eliminating the condition that could give rise to the exposure to risk.
• Prevention – combines techniques to reduce the likelihood/frequency of potential losses.
• Protection/mitigation – these are techniques whose goal is to reduce the severity of accidental losses before/after an accident occurs.
• Segregation – summarizes the techniques used to minimize the overlapping of losses from a single event. This possibility may imply very high costs:
  1. Segregation by separation of high-risk units
  2. Segregation by duplication of high-risk units.

Using principles such as elimination, substitution, moderation, and attenuation in the design phase is always better than to use them in an existing situation/process. In the former case, the approach is called design-based safety (as already explained), and in the latter case it is called “add-on safety.” Design-based safety is known to be much more cost-effective than add-on safety, certainly in the long term. Hence, from an economic viewpoint, design-based safety should always be preferred.

4.2.3 Risk Treatment Option 2: Risk Acceptance

Risk retention and risk transfer, both sub-options of risk acceptance, only differ in the financial consequences of a risk turning into an accident. Risk retention concerns intentionally or unintentionally retaining the responsibility for a specified risk. Intentional retention is referred to as “risk retention with knowledge” and can be seen as a manner of self-insurance or auto-financing, finance planning of potential losses by an organization's own resources. Unintentional retention is referred to as “risk retention without knowledge,” which is caused by inadequate hazard identification and insufficient risk assessment and management.

Usually, self-insurance will only be an option for large organizations able to set up and administrate an insurance fund. It is important to understand that only those losses that are predictable through statistical calculations, thus mainly type I risks, should be retained within an organization. Companies should avoid those risks (of mainly type II), possibly resulting in a major catastrophe or bankruptcy. The advantage of self-insurance is that insurance premiums should be lower, as there are no intermediaries expecting payments for costs, profits, or commissions. In such cases, the insured party also receives the benefit of investment income from the insurance fund that has been established, and keeps any profit accrued from it. Hence, there is an incentive for an organization to practice good risk management principles. However, there is also a downside to auto-financing: a self-insured organization will usually establish its insurance fund based on a statistical normal distribution of losses, being calculated over an extended time period. Hence, as company losses for some insurable type II risks may occur within 20 years but also the next day, there may be insufficient funds accrued to cope with certain losses, especially during the early years of the insurance fund.

Risk transfer involves shifting the responsibility for a specified risk to a third party. Insurance represents an important option for an organization to deal with risks. Risks can – in total or in part – be transferred to external agents, and hence the organization may carry out its business with the reassurance that if an accident occurs that is insured, the insurance company will provide an indemnity.

As risk transfer provides little incentive for a company to significantly reduce risk levels, there used to be a time when “risk management” was considered by company management as “insurance management.” This period is rightfully a long time ago. Companies nowadays realize that not all risks are insurable, and that for those risks that are insured, there are often large uninsured consequences, besides those that are insured and that will be compensated. Risks that are typically covered by insurance include employer's liability, public liability, product liability, fire, and transport. Uninsured risks typically include equipment repairs, employee sick pay, loss of production, staff replacement, damage to corporate image, and accident investigations. A more elaborated list of incident and accident costs is given in Section 4.3 and also further in Chapter 5 on cost-benefit analysis.

4.2.4 Risk Treatment

Risk treatment is the selection and implementation of appropriate options for dealing with risk. It includes choosing among risk avoidance, risk reduction, risk transfer, and/or risk retention, or a combination thereof. Often, there will be residual risk which cannot be removed totally as it is not cost-effective to do so. Risk treatment thus involves identifying the range of options for treating risks, assessing these options financially and preparing and implementing treatment plans. The risk management treatment measures may be summarized as:

• avoid the risk – decide not to proceed with the activity likely to generate risk;
• reduce the likelihood of harmful consequences occurring;
• reduce the consequences occurring;
• transfer the risk – cause another party to share or bear the risk;
• retain the risk – accept the risk and be prepared if an accident occurs.

Risk treatment should be looked at from an economic viewpoint. Financial aspects can play a pivotal role in advocacy and decision-making on risk treatment by demonstrating the financial and economic value of the different treatment options.

Some new concepts need to be defined to be able to develop an approach to decide between different risk treatment options, i.e., the concepts of variability, normalized variability, and hypothetical benefit.

Variability can be defined as the maximum variation between the possible costs of every risk treatment option. Variability can thus be calculated as the difference between the maximum cost and the minimum cost of risk treatment, and doing this for every risk treatment option. As the possible costs per risk treatment option really are different depending on the scenario, variability does not depend on the measurement process used to estimate the costs.

The following formula can be used to determine the variability:

The normalized variability can then be determined by:

The hypothetical benefit of the risk treatment option can be defined in two ways:

1. Definition (i) – as the difference between the highest possible costs of an accident in the current situation and those of an accident after applying the treatment measure; hence:
   
2. Definition (ii) – as the difference between the costs of retention when doing nothing (taking no action) and those of the possible accident after applying the treatment measure; hence:
   

Based on the risk attitude of the decision-maker, one of both hypothetical benefit definitions may be preferred and chosen.

Notice that uncertainty is not the same as variability (as previously explained in this book). Uncertainty is the result of not having sufficient information. It can be considered the result of not being able to measure with sufficient precision, and hence, simply put, it is the result of imprecise methods of measurement [74]. As all measurement methods are imprecise, at least to some degree, all information is accompanied by a high or a low amount of uncertainty. This is the basis of the notion of “risk” and leads to the knowledge that every aspect of decision-making in life is accompanied by risk (see also Chapter 1). It also leads to the distinction between the two types of risk: risks with a lot of information available and hence a low amount of uncertainty (so-called type I risks), and risks with a paucity of information and thus a high amount of uncertainty (so-called type II risks). Risk treatment calculations such as those suggested and illustrated in this section should only be carried out if adequate financial information is available. This relates to type I risks and the more common type II risks.

In the case of definition (i), calculation of the Maxmax hypothetical benefits, emphasis is placed on the consequences of an event, irrespective of the probabilities. In the case of definition (ii), calculation of the expected hypothetical benefits, probabilities are considered. Therefore, definition (i) may be interesting for decision-makers putting more emphasis on consequences (or in case there is a lack of probability information, such as with some type II risks), while definition (ii) would probably be more interesting for decision-makers taking consequences as well as probabilities into consideration (and disposing over the probability information).

It should be noted by the reader that, besides the choice of the definition to determine the hypothetical benefits, which can be rather subjective, the risk treatment calculations approach explained in this section is highly rational and only financial considerations are used to make the calculations and recommendations. No moral aspects, such as equity, justification of the risk, and other ethical aspects, are taken into account in this approach. Therefore, if used, it should be applied with this knowledge in mind. Ethical aspects will be discussed later in this chapter.

4.2.5 The “Human Aspect” of Making a Choice between Risk Treatment Alternatives

Different factors play a role when taking decisions and making choices between various alternatives. The decision-making process becomes even more complicated in an organizational context. Managers need to make decisions concerning issues that affect not only their personal lives, but also the company they work for, its employees, its surroundings, and more. The majority of management problems of any enterprise, including safety investment portfolio management, is characterized by uncertainties and lack of necessary information. The difficulty in predicting future parameter values and future events has an impact on the evaluation of safety investment projects. Uncertainty, or the lack of information, thus obviously hampers managerial decisions. To decrease the level of uncertainty, managers may use historic data, trends, statistical information, qualitative expert judgments, past achievements, and all other information available to the company [37, 75].

Managerial behavior and decision-making sometimes have little affinity with real skills and available resources. The way people think and people behave is much more linked to situational perception and the ability to control processes and potential results. Managers may make different decisions in a similar situation as a result of a different interpretation and evaluation of the situation at hand. Decisions can be divided into two groups: opportunities and threats. Managers usually view controllable situations as opportunities and uncontrollable ones as threats. However, what is interpreted as “controllable” and as “uncontrollable” depends entirely on the person, and varies strongly from manager to manager. Therefore, it is possible that one manager sees a situation characterized by a certain level of uncertainty as an opportunity, while another manager sees the same situation as a threat [75–77].

4.2.5.1 Safety Increase Premium

Preferences toward safety can be described (as already indicated in Chapter 3), by a safety utility function and provide, for example, an idea of the safety state difference one is willing to suffer to leave the person indifferent between an uncertain (but higher) safety state (point B in Figure 4.6) and a certain (but lower) safety state (point A in Figure 4.6). “Uncertain” in this regard indicates that management feels less certain about the effectiveness of the higher safety situation than that of the lower safety situation, and asks, “Is it worth the trouble or money?”

The safety increase premium can then be calculated as the extra budget that is required to cover the difference between safety state x** and x*, because a certain safety situation x* delivers the same expected utility as the uncertain safety situation x** and its corresponding expected value. Hence, the safety premium can be regarded as the amount of money that safety management needs to invest to get into a higher safety situation (but one perceived as more uncertain with respect to its effectiveness). It is the minimum amount that risk-averse management (cf. the shape of the safety utility function) would need to spend on safety to leave it indifferent between the uncertain and the certain safety situations.

4.3.1 Costs and Hypothetical Benefits

Accidents do bear a cost – and often not a small one. An accident can be linked to a variety of direct and indirect costs. Table 4.1 gives a non-exhaustive list of potential costs that might accompany accidents.

Meyer and Reniers [73]. Reproduced with permission from De Gruyter.

Hence, by implementing a sound safety policy and by adequately applying operational risk management, substantial costs can be avoided, namely all costs related to accidents that have never occurred (i.e., the non-events), the so-called “hypothetical benefits.” However, in current practice, companies place little or no importance on the “hypothetical benefit” concept due to its complexity. In Section 4.2.4 an attempt has been made to make the concept more tangible. In Section 8.12 the concept is explored even more in depth, as hypothetical benefits are equated and modeled as a maximum investment willingness.

Non-quantifiable costs are highly dependent on non-generic data such as individuals' characteristics, a company's culture and/or the company as a whole and even socio-economic circumstances. Rather, the costs assert themselves when the actual costs supersede the quantifiable costs. In economics (e.g., in environment-related predicaments) monetary evaluation techniques are often used to specify non-quantifiable costs, among them the contingent valuation method and the conjoint analysis or hedonic methods. In the case of non-quantifiable accident costs, various studies have demonstrated that these form a multiple of the quantifiable costs [73].

The quantifiable socioeconomic accident costs (see Table 4.1) can be divided into direct and indirect costs. Direct costs are visible and obvious, while indirect costs are hidden and not immediately evident. In a situation where no accidents occur, the direct costs result in direct hypothetical benefits, whilst the indirect costs result in indirect hypothetical benefits. The resulting indirect hypothetical benefits comprise, for example, not having sick leave or absence from work, not having staff reductions, not experiencing labor inefficiency and not experiencing change in the working environment. Figure 4.7 illustrates this reasoning.

Although hypothetical benefits seem to be rather theoretical and conceptual, they are nonetheless important if you are to fully understand safety economics. Hypothetical benefits resulting from non-occurring accidents or “non-events” can be divided into different categories at the organizational level, depending on the preferences and characteristics of the organization and its safety management. Meyer and Reniers [73], for example, mention five classes of hypothetical benefits. The first category concerns the non-loss of work time and includes the non-payment of the employee who at the time of the accident adds no further value to the company (if payment were to continue, this would be a pure cost). The non-loss of short-term assets forms the second category and can include, for example, the non-loss of raw materials. The third category involves long-term assets, such as the non-loss of machines. Various short-term benefits, such as non-transportation costs and non-fines, constitute the fourth category. The fifth category consists of non-loss of income, non-signature of contracts or non-price reductions. In Chapter 5, hypothetical benefits are elaborated in greater depth. Independent of the number of classes or categories used, the visible or direct hypothetical benefits generated by the avoidance of costs resulting from non-occurring accidents only make up a small portion of the factors responsible for the total hypothetical benefits resulting from non-occurring accidents.

Next to tangible benefits, intangible benefits might exist. Intangible benefits may manifest themselves in different ways, e.g., non-deterioration of image, avoidance of lawsuits, and the fact that an employee, thanks to the safety policy and the non-occurrence of accidents, does not leave the organization. If an employee does not leave the organization, the most significant benefit arises from work hours that other employees do not have to make up. Management time is consequently not given over to interviews and routines surrounding the termination of a contract. The costs of recruiting new employees can, for example, prove considerable if the company has to replace employees with experience and company-specific skills. Research into the reasons that form the basis of recruitment of new staff reveals a difference between, on the one hand, the recruitment of new employees due to the expansion of a company and, on the other hand, the replacement of staff who have resigned due to poor safety policies.

4.3.2 Prevention Benefits

An accident that does not occur in an enterprise, thanks to the existence of an efficient safety and prevention policy within the company, was referred to as a non-occurring accident or a non-event. Non-occurring accidents (in other words, the prevention of accidents) result in the avoidance of a number of costs and thus create hypothetical benefits, as explained previously. An estimation of the amount of input and output of the implementation of a safety policy is thus clearly anything but simple. It is impossible to specify the costs and benefits of one exceptional measure. The effectiveness (and the costs and benefits) of a safety policy must be regarded as a whole.

Hence, if an organization is interested in knowing the efficiency and the effectiveness of its safety policy and its prevention investments, in addition to identifying all kinds of prevention costs, it is also worth calculating the hypothetical benefits that result from non-occurring accidents. By taking all prevention costs and all hypothetical benefits into account, the true prevention benefits can be determined.

4.3.3 Prevention Costs

In order to obtain an overview of the various kinds of prevention costs, it is appropriate to distinguish between fixed and variable prevention costs, on the one hand, and direct and indirect prevention costs on the other.

Fixed prevention costs remain constant irrespective of changes in a company's activities. One example of a fixed cost is the purchase of a fireproof door. This is a one-off purchase and the related costs are not subject to variation in accordance with production. Variable costs, in contrast to fixed costs, vary proportionally in accordance with a company's activities. The purchase of safety gloves can be regarded as a variable cost due to the fact that the gloves have to be replaced sooner when used more frequently or more intensively due to increased productivity levels.

Variable prevention costs have a direct link with production levels. Fixed prevention costs, by contrast, are not directly linked to production levels. A safety report, for example, will state where hazardous materials must be stored, but this will not have a direct effect on production. The development of company safety policy includes not only direct prevention costs, such as the application and implementation of safety material, but also indirect prevention costs such as development and training of employees and maintenance of the company safety management system.

A non-exhaustive list of prevention costs is as follows:

• staffing costs of company HSE department;
• staffing costs for the rest of the personnel (time needed to implement safety measures, time required to read working procedures and safety procedures, etc.);
• procurement and maintenance costs of safety equipment (e.g., fire hoses, fire extinguishers, emergency lighting, cardiac defibrillators, pharmacy equipment);
• costs related to training and education with respect to working safely;
• costs related to preventive audits and inspections;
• costs related to exercises, drills, simulations with respect to safety (e.g., evacuation exercises, etc.);
• a variety of administrative costs;
• prevention-related costs for early replacements of installation parts, and so on;
• maintenance of machine park, tools, and so on;
• good housekeeping;
• investigation of near-misses and incidents.

In contrast to quantifying hypothetical benefits, companies are usually very experienced in calculating direct and indirect (non-hypothetical) costs of preventive measures.

4.6.1 Accident Metrics

For accidents defined as occurrences that result in a fatality, permanent disability or time lost from work of 1 day/shift or more, usually the LTI frequency rate (LTIFR) is used and these accidents are referred to as “LTI accidents.” The LTIFR is the number of lost time injuries per million hours worked, calculated using the following equation:

Hence, the LTIFR is how many LTIs occurred over a specified period per 1 000 000 hours (or some other number; 100 000 is also often used) worked in that period. Mostly, the accounting period is chosen to be 1 year. By counting the number of hours worked, rather than the number of employees, for example, discrepancies in the incidence rate calculation as a result of part-time workers and overtime are avoided. However, this metric using the employees instead of the number of hours worked [called the lost time injury incidence rate (LTIIR)] is also used in many organizations. To calculate the LTIIR, which is the number of LTIs per 100 employees, the following equation is used:

Next, the severity rate, which takes into account the severity per accident, is also often used. Depending on how this is expressed, at least the information from above and the number of work days lost over the year are needed. Often the severity rate is expressed as an average by simply dividing the number of days lost by the number of LTIs. Another way of calculating the LTI severity rate (LTISR) is to use the following equation (the figure 1 000 000 may be replaced by any other figure; it just tells us that the LTISR in this case is expressed per million hours worked):

Also, the medical treatment injury (MTI) frequency rate is often measured. This frequency rate measures how often MTIs are occurring. It is expressed as the number of MTIs per million hours worked:

Finally, the total recordable injury frequency rate (TRIFR) measures the frequency of recordable injuries, i.e. the total number of fatalities, LTIs, MTIs, and restricted work injuries occurring. It is expressed as the total number of fatalities, LTIs, MTIs, and restricted work injuries per million hours worked:

4.6.2 A Quick Cost-estimation Approach for Type I Risks

Companies usually have a good understanding of the cost per sort of type I accident. For example, the average cost of an LTI accident is calculated on a yearly basis by organizations, and equals €x. Similarly, the average costs of the different sorts of accidents can be determined. Figure 4.14 shows some theoretical ways of calculating the different costs.

Based on these average costs, a rough estimate of the total yearly cost due to type I accidents can be made. Every company usually knows very well the number of serious accidents that happen annually, but the numbers of other type I accidents with lesser consequences are often unknown. Nonetheless, a rough estimation of all accident costs can be made using the type I (e.g., Bird) pyramid principle. In principle, an organization should draft its own pyramid, and use these ratios. Assume that the number of serious accidents is N, and hence this rough calculation can be done for any company. Table 4.2 displays how to calculate the total yearly accident costs.

Table 4.2 shows that, based on the ratio between “serious” type I accidents and other sorts of accidents, a rough estimate can be made of the total average accident costs for a given year if the number of incidents and accidents in that year is known, and if the average cost per sort of accident is known. Table 4.2 doesn't take into consideration the fact that only around one-fifth of all accidents lead to serious accidents (see Section 4.5), as this knowledge has no impact on the overall costs of all incidents happening in the organization. It does, however, have an impact on the amount of costs avoided purely related to serious accidents, and this should be taken into account when calculating those avoided costs.

This method can be used by a company to estimate, for example, the accident cost line displayed in Figure 4.8, when calculating the costs for different levels of safety. Clearly, the definition of a “level of safety” would have to be agreed upon within the company, and estimations may then be carried out based on this definition.

4.7.1 Introduction to a Study on Type II Event Decision-making

It is very difficult, if not impossible, to elaborate on a “quick calculation” tool for estimating type II accident costs. In fact, it could be very dangerous as well. It is possible that company managers might reduce the decision-making about type II accidents to a simple mathematical formula, and such a practice would be irresponsible, unacceptable, and wrong. If there is one thing that history teaches, it is that one should be extremely careful with safety investment decision-making where extremely low-frequency events are involved. Hence, instead of working out a method for the quick calculation of type II accidents, we present the results of a study by Van Nunen et al. [85] on decision-making in the case of type II events. It is more of a “psychological” problem than a rational one: the hypothetical benefits achieved in the case of averting a true type II accident are almost always higher than the safety investment costs (SICs) of successful accident avoidance.

The subject of the study concerned the investigation of the influence of probability change in averting a certain loss due to a major (type II) accident. The question that the respondents needed to answer was basically whether they preferred an investment in safety (prevention measures – representing an uncertain gain) or an investment in production (representing a certain gain), for varying levels of potential losses accompanied by varying probabilities of avoiding these losses. The research thus aimed to discover which parameters of consequence and probability would persuade people that investing in production was worth the major accident risk, and which parameters would make the risk or uncertainty unacceptable, leading them to invest in major accident prevention. Knowledge as to how these decisions are made by people in general is obviously important for the understanding and management of activities involving potential type II events [86].

Concerning the decision-making under risk, as already mentioned, accidents with major consequences are included, as well as a variety of probabilities of occurrence. If both the probability of occurrence and the disaster potential are perceived as high, one would normally reject such risks [87]. The acceptance of accidents with high disaster potential and a low probability of occurrence, so-called HILP accidents (i.e., type II accidents), is far less straightforward [46, 51]. It could be argued that the occurrence of large-scale accidents is unacceptable regardless of their probability. On the other hand, it can be argued that safety has a cost that makes it impossible for organizations to spend an unlimited budget reducing or eliminating all (major) accident scenarios. Therefore, a certain level of risk and uncertainty has to be accepted [88].

In addition to the decision-making under risk (the outcomes as well as the probabilities of each outcome are known), decision-making under uncertainty can also be considered. In an uncertain situation, the probability of an accident occurring is completely unknown and/or the amount of the loss as a result of the accident is also unknown. When these uncertainties remain, subjective judgments are inevitable [87], which makes it difficult to predict the decision-making.

It should be noted that the general results of the choices between the production investment and the prevention investment were compared with the cumulative expected values of these investments. As mentioned at the beginning of this chapter, the theory of expected value can provide a reference for discussing how the decisions are taken [86].

The problem setting is as follows. If a respondent has chosen a production investment, the company will make, during the next 5 years, an extra yearly production profit of €500 000. So, after a 5-year period, the production investment will have resulted in an extra profit of €2 500 000 (interests aside).

The cumulative expected value of the prevention investment depends on the probability that an accident will occur and on the associated amount of losses. The calculation of the cumulative expected value is given for the following example: assume a prevention investment that avoids a major accident with probability of 1 in 100 000 and losses worth €20 000 000 per year during the next 5 years. A probability of 1 in 100 000 corresponds to a probability of 0.001%. This brings the cumulative expected value to (0.001% × 5) × €20 000 000. So, after 5 years, the cumulative expected value will be €1000. The same calculation was carried out for all other combinations of probabilities and losses due to major accidents considered in the questionnaire.

In Table 4.3, the investment (production or prevention) entailing the highest cumulative expected value is given. Based on the answers of the respondents, for each given probability and possible loss, it was calculated whether the largest group of respondents opted for the production or the prevention investment. The distribution of the matrix from the answers of the respondents was then compared with the matrix from Table 4.3.

As previously stated, several factors can have an influence on the decision-making process. Some factors were thus included in the analyses to determine whether people would decide in a more risk-averse or risk-seeking way. The results were compared according to gender (male or female). Based on the Short Rational-Experiential Inventory, respondents with a high rational thinking style were compared with those with a low rational thinking style, and respondents with a high intuitive thinking style were compared with those with a low intuitive thinking style. Based on the Brief Sensation-Seeking Scale, the choices of the respondents with high sensation-seeking behavior were compared with those with low sensation-seeking behavior.

4.7.2 Results of the Study on Type II Event Decision-making

In Table 4.4, the proportion of respondents opting for the production or prevention investment is given. Table 4.5 shows whether the largest group of respondents opted for the production investment or for the prevention investment. In this table, there is also a comparison between the choices of the respondents and the cumulative expected values of these investments: the distribution of the matrix from the answers of the respondents is compared with the matrix in Table 4.3. For the unknown probabilities of occurrence and the unknown losses of the accident, the cumulative expected value cannot be calculated, which makes this comparison impossible for these investments (in italics in Table 4.5).

The distribution of the investment of the respondents that does not match the distribution of the investment with the highest cumulative expected value is indicated by an asterisk. In cases where a comparison between the distribution of the investment of the respondents and the distribution of the investment with the highest cumulative expected value is not possible, italics are used.

According to calculated cumulative expected values, the higher the accident probability and the higher the possible loss, the more advantageous it is to choose a prevention investment. If the accident probability is equal to 1 in 100 000, then, according to the theory of expected values, it is always better to opt for the production investment, regardless of the possible loss of the accident (considering the numbers that were used in the survey). The survey results indicate that the respondents make decisions in a more risk-averse way than can be anticipated by the theory of expected values. The majority of the respondents opt for the production investment only when the possible loss of a major accident is equal to €100 000 000 or lower. Regarding the higher probabilities of occurrence, i.e., 1 in 10 000 and 1 in 100, the respondents behave in a more risk-averse way than the cumulative expected values predict. This means that these respondents, being laypeople, also expect company safety managers to be cautious and choose prevention instead of production in such cases. It thus becomes obvious that moral principles should be seen as an important part of decision-making regarding type II risks, in order for them to be acceptable by laypeople. Klinke and Renn [87] explain this risk-averse behavior through the moral obligation that people have to prevent harm to human beings and the environment. They argue that risk refers to the experience of something that people fear or regard as negative. Another explanation can be found in the framework of Random Regret Minimization, which postulates that, when choosing, people anticipate and aim to minimize regret, and therefore behave in a more risk-averse way [89] (see also in the introductory section of this chapter).

As already mentioned, it is extremely difficult to predict decision-making in an uncertain situation where there is no knowledge whatsoever about the probability and/or the losses. It turns out that when there is uncertainty concerning the possible loss of an accident, the majority of respondents opt for the prevention investment, regardless of the probability of the accident occurring. As the accident's probability increases, the number of respondents that choose the production investment decreases. The number of respondents choosing the production investment decreases where the possible losses increase. When there is complete uncertainty, i.e., where both the accident probability and the possible loss are unknown, the majority (95%) opts for the prevention investment. With complete uncertainty, the risk is mostly categorized as intolerable, as the consequences might be catastrophic. Therefore, the risk-averse attitude is perceived as appropriate [87]. Notice that this finding also provides an argument for the precautionary principle.

4.7.3 Results by Gender

Table 4.6 shows the proportion of respondents opting for the production or the prevention investment by gender. When there is a significant difference (P < 0.05) between investments of the male respondents and the female respondents, this is indicated with an asterisk.

^a There is a significant difference (P < 0.05) between the investments of the male and female respondents.

There are significant differences between male and female respondents for the lower probabilities of occurrence (1 in 100 000 and 1 in 10 000) in combination with higher possible losses (€500 000 000, €1 000 000 000, and €10 000 000 000). For these combinations, men behave in a more risk-seeking way, i.e., they are more likely to opt for the production investment. When the possible loss increases, this difference between men and women decreases. The results are consistent with existing studies indicating that men behave in a more risk-seeking way than women (e.g., [14, 90, 91]). When it comes to making decisions regarding type II events, men display more risk-seeking decision-making behavior than women. This study also shows that men – regardless of whether they have to take decisions – have higher levels of rational thinking style and sensation-seeking than women, and that women – regardless of whether they have to take decisions – have higher levels of intuitive thinking style (see also the following section).

4.7.4 Rational and Intuitive Thinking Styles

The study revealed that for the combinations of a probability of occurrence of 1 in 10 with possible losses of €20 000 000, €50 000 000, and €100 000 000, the respondents with a high rational thinking style behave in a more risk-averse way than those with a low rational thinking style. For the combination of a probability of occurrence of 1 in 100 000 with an unknown possible loss, respondents with a low intuitive thinking style follow the overall results, i.e., a prevention investment. However, the majority of the respondents with a high intuitive thinking style opted for a production investment for the combination of a probability of occurrence of 1 in 100 000 with an unknown possible loss. These differences are statistically significant. Another significant difference between the high and low intuitive thinking styles is found for the combination of a probability of 1 in 10 000 with an unknown possible loss: respondents with a low intuitive thinking style are more likely to behave in a risk-averse way than respondents with a high intuitive thinking style.

Butler et al. [91] also have done research on how intuition and reasoning or rationality affect the decision-making under risk and uncertainty. They obtained similar results: people with a high intuitive thinking style are more risk-seeking and people with a high rational thinking style are less risk-seeking. Based on the terminology of Stanovich and West [92], individuals with a high rational thinking style rely on effortful, deliberative reasoning and systematic processing of information. On the other hand, when decisions are based on intuition, there is no systematic comparison of alternatives: a decision is taken at glance, by rapidly evaluating the main features of the problem [91]. An explanation for the finding that people with a high intuitive thinking style behave in a more risk-seeking way could be the fact that the high speed of intuitive thinking puts intuitive thinkers at a comparative advantage in situations involving high risk and uncertainty, making them less averse. Intuition can handle severe uncertainty so that individuals who are better at using intuition may feel more comfortable dealing with uncertainty and risk and thus develop higher tolerance for both [91, 93–96]. The downside is that they are only human, and, like anyone, they may become complacent or over-optimistic, which could make them blind for disaster. Hence, the high reliability organization (HRO) principles, as discussed in Chapter 2, should be applied to overcome such a possibility.

For the combination of a probability of 1 in 10 000 and an unknown possible loss, respondents with a high sensation-seeking style make decisions in a more risk-seeking way than respondents with a low sensation-seeking style. As already shown in a number of studies, higher levels of self-reported sensation-seeking are indeed associated with greater risk taking on various domains (e.g., [97–100]).

4.7.5 Conclusions of the Study on Type II Event Decision-making

Decision-making under risk and uncertainty is obviously not straightforward, and the acceptance of risk and uncertainty is influenced by a number of factors. Knowledge of these decision-making processes is important for the understanding and management of activities involving potential major accident events. This study illustrates that people behave in a more risk-averse way as compared with what would be expected based on the theory of expected values, in the case of decision-making involving type II risks. Only for low accident probabilities combined with low potential losses do the respondents take more risk-seeking decisions and opt for production investments. Concerning decision-making under uncertainty, the respondents also make risk-averse decisions: only for known and relatively low possible losses do they opt for the production investment; otherwise they always choose prevention. Under complete uncertainty, almost all respondents behave in a risk-averse manner. The study also showed that men are more likely to behave in a risk-seeking way than women, that people with a high intuitive thinking style are less risk-averse than those with a low intuitive thinking style, that people with a high rational thinking style are more risk-averse than those with a low rational thinking style, and that respondents with a high sensation-seeking style behave in a more risk-seeking way than those with a low sensation-seeking style. In other words, women and people with a low intuitive thinking style, a high rational thinking style, or a low sensation-seeking style will take more cautious decisions regarding investments when coming to a choice between production and prevention in the case of type II risks.

4.10.1 Risk Acceptability

Risk acceptability is an extremely difficult and complex issue. The problem starts with the questions, acceptable for whom, and from whose perspective? In other words, who suffers the consequences when something goes awfully wrong and disaster strikes, on the one hand, and who gains the benefits when all goes well and profits are made, on the other? Are the risks equally spread? Are the risks justified/defensible and, even more importantly, are they just? Moral aspects always start to emerge when discussing the acceptability of risk, in other words, when asking the question “how safe is safe enough?”

Independent of the personalities of people, the discussion and debate about what risks and levels of risk are acceptable continues. Some people argue that one fatality is one too many, and others interpret the prevailing accident rate in areas of voluntary risk-taking as a measure of the level of risk that society as a whole finds acceptable [103]. Obviously, both viewpoints have their merits. No one will argue against the fact that one death is one too many. But it also seems reasonable to assume that voluntary risk levels can be used as some sort of guideline for involuntary risk levels. However, both perspectives are far from usable in the real industrial world. On the one hand, lethal accidents do happen and should not be economically treated as if they were not possible. So being part of industrial practice and real-life circumstances, fatalities should be taken into account in economic analyses. On the other hand, research indicates that voluntary risk cannot be compared with involuntary risk. People are much less willing to suffer involuntary than voluntary risks, and the risk perception that people have about involuntary risks is much higher than that about voluntary risks [104]. Hence, these two sorts of risk (i.e., voluntary and involuntary risks) should not be used interchangeably in economic analyses, and risk criteria should not be based on them.

In this book, risks and dealing with risks are viewed from a microeconomic decision-making perspective. Hence, the focus is on the optimal operational safety decision, based on the information available and thereby taking economic issues into account. Risks are relative, and making the best resource allocation decision for operational safety in a company means avoiding as much possible loss as possible within a certain safety budget. However, due to the “acceptability” aspect of risks this seems easier than it is in reality. One of the best known and most used principles in this regard is the proactive concept of “as low as reasonably practicable” (ALARP). The term implies that the risk must be insignificant in relation to the sacrifice in terms of money, time, or trouble required to avert it. Hence, ALARP means that risks should be averted unless there is a gross disproportion between the costs and the benefits of doing so. The difference between ALARP and other terms such as “best available technology” (BAT), “best available control technology” (BACT), and “as low as reasonably achievable” (ALARA) can best be described as the observation that to follow the ALARP approach, not only should the technology be available, but also the costs of prevention should be reasonable. BAT and ALARA demand to do work, research, engineering, and so on, to make the prevention work, irrespective of the costs. The term “so far as is reasonably practicable” (SFAIRP) is used in health and safety regulations in the UK, and should not be confused with ALARP, which has no legislative connotation. The SFAIRP term has been defined in UK courts. The formal definition given by Redgrave [105] is:

‘Reasonably practicable’ is a narrower term than ‘physically possible’, and implies that a computation must be made in which the quantum of [operational] risk is placed in one scale and the sacrifice involved in the measures necessary for averting the risk (whether in money, time or trouble) is placed in the other, and that, if it be shown that there is a gross disproportion between them – the risk being insignificant in relation to the sacrifice – the defendants [persons on whom the duty is laid] discharge the onus upon them [of proving that compliance was not reasonably practicable]. Moreover, this computation falls to be made by the owner at a point of time anterior to the accident.

An acronym similar to ALARP (but with slightly different meaning as regards the word “reasonable”) is “best available technology not entailing excessive costs” (BATNEEC). Other acronyms focusing on the legislative (and reactive) part are “cheapest available technology not invoking prosecution” (CATNIP) and “as large as regulators allow” (ALARA – second meaning) .

It is clear that there is a diversity of acceptability approaches out there, but the most well known and the most used is undoubtedly ALARP. ALARP is also the most useful on an organizational level, as the risk level of being ALARP is influenced by international guidelines and directives, the progress of societal knowledge of risk, the continuous evolution of people's perception of what “risk” constitutes, political preferences and other forms of regulation in different industries. Hence, the ALARP principle allows us to have a different risk judgment depending on industrial sectors, risk groups, risk-prone areas, and even organizations.

The relationship between the ALARP principle and the terms “intolerable,” “tolerable,” “acceptable,” and “negligible risk” is illustrated in Figure 4.18.

Figure 4.18 shows that it is possible to distinguish between “tolerable” and “acceptable.” The subtle distinction between both terms is used to indicate that a level of risk is never accepted, but it is tolerated in return for other benefits which are obtained through activities, processes, and so on, generating the risk [106]. Figure 4.18 illustrates that the activities characterized by high levels of risk are considered intolerable under any normal circumstances. At the lower end, there is a level below which risk is so low that it can be ignored – i.e., it is not worth the cost of actively managing it. There is a region between these two limits, called the ALARP region, in which it is necessary to make a trade-off between the risk and the cost of further risk reduction.

The practical use of ALARP within one single organization can be demonstrated by using the risk assessment decision matrix (see also [73]). The goal of all reduction methods is summarized in Figure 4.19, where one can observe that risks that are considered unacceptable (with the visual help of the risk matrix) have to be brought down to an acceptable level or at least to one that is tolerable.

In the middle zone of the matrix, two intermediate regions, “2” and “3”, between the unacceptable zone “1” (needing immediate action) and the negligible zone “4” can be noted in diagonal. These zones are the ones where the ALARP principle occurs. Using the risk matrix, it is thus easily possible for an organization to make a distinction between the tolerable region “2” and the acceptable region “3” as noted in Figure 4.19, and to link certain actions to it, specifically designed by and for the company.

In any case, the ALARP principle needs a decision rule (or criteria) specifying what is “reasonable” for the person, group of persons, or organization using it. The decision will ultimately depend on a combination of physical limits, economic constraints, and moral aspects. The advantage is that the principle works in practice, but the downside is that it will sometimes lead to inconsistencies in effective valuation of various risks, and have inefficiencies in the sense that it may be possible in some cases to save more lives at the same cost, or the same number of lives at a lower cost [74]. The next section discusses some criteria that are widely used to make decisions using ALARP.

There are a number of disadvantages or issues concerning the using of economic (e.g., cost-benefit) analyses for ALARP. For example, there is a difference between the willingness to pay (WTP) and willingness to accept (WTA) evaluations (see also Section 4.10.4.3), both approaches that are often used to put values on (un)safety. There are also problems of understanding “gross disproportionality” and of putting a value on human life. Furthermore, sometimes risks are only replaced by (exported to) another facility not falling under the same (or under any) ALARP calculation.

4.10.2 Risk Criteria and Risk Comparison

Risk criteria are related to the definition of risk and the target exposed to the risk. Within a single organization, there can be a number of possible targets: employees, groups of employees, material assets of the company, non-tangible assets of the company (such as reputation, image), intellectual property of the company, and also surrounding communities and the society as a whole.

As this book is only concerned with operational risks, and not, for example, with voluntary risks, natural-technological risks, or terrorist risks, no policy factor varying with the degree to which participation in the activity is voluntary and with the perceived benefit needs to be introduced into the risk calculation. All operational risks are in essence involuntary, for citizens living nearby the industrial activity but also for the employees working at the organization. However, there is a difference between a company's employees and its surrounding communities: i.e., the benefits arising from the industrial activity. The perceived risk will thus be different between both groups of people. This is the problem of equity or distribution of risk. Those people who take the risk are often not the same as those who bear the risk. As Ale et al. [107] indicate, when the rewards of risk-taking go to the risk creators and the costs are carried by the risk bearers, a strong incentive is created for a small group to take large risks at the expense of others. Moreover, the increase in productivity, turnover, and/or profits as a total may be maximized, but some employees may have more profit than others while bearing less risk. Therefore, this moral aspect should be considered when carrying out an economic analysis and establishing risk criteria. Section 4.10.4 treats this question in more depth.

If one considers only human losses (injuries and fatalities), there are different possible approaches to calculating risk (using a strictly rational point of view), to subsequently base the necessary risk criteria on human-related risks. Two very well-known approaches that are widely used are the calculation of the “location-based (individual) risk” and the “societal risk.” An individual risk provides an idea of the hazardousness of an industrial activity. A societal risk takes the exposure of the population in the vicinity of the hazardous activity into account in the calculation.

4.10.2.1 Location-based (Individual) Risk

An individual risk can be defined in general as “the frequency with which a person may expect to sustain a specified level of harm as a result of an adverse event involving a specific hazard.” Hence, the individual risk can be used to express the general level of risk to an individual in the general population, or to an individual in a specified section of the community. Legislators often use levels of individual risk with “specified level of harm” equal to “fatality” (such risks should actually be called “individual fatality risks”) as a regulatory approach to setting risk criteria. In the process industries, for example, the individual (fatality) risk is defined as “the risk that an unprotected individual would face from a facility if he/she remained fixed at one spot 24 hours a day 365 days per year.” Therefore, the risk is also sometimes called location-based (individual) risk. A location-based risk describes the geographic distribution of individual risk for an organization. It is shown using so-called iso-risk curves, and is not dependent on whether people or residences are present (see Figure 4.20).

Location-based risk is used to assess whether individuals are exposed to a greater than acceptable risk in the locations where they may spend time (e.g., where they live or work). It does not directly provide information on the potential loss of life, nor does it distinguish between exposure affecting employees and the general (surrounding) population. In many countries, an additional fatality risk from industrial activities of 10⁻⁶ (1 per million)/year to a person exposed to this fatality risk is considered to be a very low level compared with risks that are accepted every day, and hence used as a risk criterion. The reasoning for this risk criterion is based on what is known about risk perception. On the one hand, the individual risk of being killed while driving a car is estimated (very generally) as 10⁻⁴/year. If the level of (individual) risk is higher than driving a car, it is perceived as unacceptable. On the other hand, the individual risk of being struck by lightning is estimated as 10⁻⁷/year, and this risk level is perceived (in general) to be so low that it is acceptable.

Risks of the same type can thus be compared with one another to agree upon a risk criterion. There are actually a number of reasons for comparing risks with each other. The most important reason might be that by comparing risks, it is possible to improve the understanding and the perception of risks, both by the general public and by experts. It is difficult to grasp the meaning of “one in a million,” although people do tend to have a natural feeling and intuition for categorizing risks into low–medium–high, for example. By comparing lesser known risks with more familiar risks, the familiarity and understanding of known or older risks can be transferred to new and unknown risks. Table 4.8 helps to place different risks in perspective, by quantifying the one-in-a-million (10⁻⁶) risk of dying from various activities.

1. Smoking two cigarettes (risk of heart disease included)

2. Eating 100 g servings of shrimp

3. Eating 35 slices of fresh bread

4. Eating 350 slices of stale bread

5. Eating one-half basil leaf (weighing 1 g)

6. Drinking 70 pints of beer in 1 year

7. One-quarter of a typical diagnostic chest X-ray

8. A non-smoker living in a home with a smoker for 2 weeks

All of these risks are risks relevant to adults consuming this amount. Children consuming half this amount would be at comparable risk.

Wilson and Crouch [74]

Individual fatality risks in an industrial context are calculated by multiplying the consequences and the frequency of undesired events. For example, if the severity of an industrial accident is such that there is a probability p of killing a person at a specified location [the probability merely takes into account the level of lethality due to the accident (e.g., due to heat radiation or due to a pressure wave), but does not consider population figures], and the accident has a annual frequency of f, then the individual fatality risk at this particular location due to this event is p × f per year. Where there is a range of incidents that expose the person at that point to risk, the total individual fatality risk is determined by adding the risks of the separate incidents/events.

Contours of identical risk level (such as those in Figure 4.20) can then be plotted around an industrial activity, and can be used to present the risk levels surrounding the activity. Different levels of individual fatality risk can then be used by companies to discern between different company sites. A distinction can be made, for example, among production areas, administration areas, commercial areas, parks and fields, fire department, and care units .

4.10.2.2 Societal Risk or Group Risk

Calculating the individual fatality risk around a specific industrial activity does not make a distinction between, for example, the activity taking place somewhere in the desert or in a major city center. The calculated individual risk will be the same, regardless of the number of people exposed to the activity. However, it is evident that in reality the level of risk will not be identical in both situations: the level of risk will be higher if the industrial activity takes place in the city, rather than in the desert. This is a result of people living in the neighborhood of the activity, and thus being exposed to the danger. To take the exposed population figures into account, a so-called societal risk is calculated. The societal risk, also called group risk, is defined as “the probability that a group of a certain size will be harmed – usually killed – simultaneously by the same event or accident” [108]. It is presented in the form of a so-called “FN curve.” Each point on the line or curve represents the probability that the extent of the consequence is equal to or larger than the point value. These curves are found by sorting the accidents in descending order of severity, and then determining the cumulative frequency. As both the consequence and the cumulative frequency may span several orders of magnitude, the FN curve is usually plotted on double logarithmic scales. A log–log graph as depicted in Figure 4.21 is obtained. For a concrete example on how to calculate and plot an FN curve, see Section 4.11.2.3.

The different steps in Figure 4.21 show the probabilities (cumulative frequencies) of different scenarios. The societal risk is designed to show how risks vary with changing levels of severity. FN curves are therefore often used for comparison with a “boundary line” representing a norm following legislation. This boundary line is also called the societal risk criterion. As an example, a boundary line fixed by Flemish law is given in Figure 4.21. This type of boundary was originally proposed by Farmer in 1967, as explained in Duffey and Saull [109], in a paper that launched the concept of a boundary line for use in the probabilistic safety assessment of nuclear power plants. The boundary line actually represents the transition region between the tolerable region and the unacceptable region. For example, in theory (not taking moral aspects into consideration at this time), a hazard may have an acceptable level of risk for 20 fatalities, but may be at an unacceptable level for 100 fatalities. Usually, such a boundary line, if it exists, is determined by the authorities, but it can also be fixed by individual companies for internal use.

In some jurisdictions, there are two defined boundaries (societal risk criteria) on the FN graph, i.e., separating the zones of high risk (unacceptable region), intermediate high risk (tolerable region), and intermediate low risk to low risk (acceptable region and negligible region) (see also Meyer and Reniers [73]). It is common, where an industrial activity is calculated to generate risks in the tolerable region, to require the risks to be reduced to an ALARP level (see also the previous section), provided that it can be proved in some way that the benefits of the activity that produces the risks are seen to outweigh the generated risks.

Mathematically, the equation for an FN risk criterion may be represented as [110]:

or:

where F is the cumulative frequency of N or more fatalities; N is the number of fatalities; a is an aversion factor (usually between 1 and 2); and k is constant. From the equation, it is clear that the slope of the societal risk criterion (when plotted on a log–log basis) is a and represents the degree of aversion to multi-fatality events embodied in the criterion:

For instance, if a = 1, the frequency of an event that results in 100 fatalities or more should be 10 times lower than the frequency of an event that results in 10 or more fatalities. If a = 2, the frequency of an event that results in 100 or more fatalities should be 100 times lower than the frequency of an event that results in 10 fatalities or more.

In enterprises encountering numerous hazards with severe potential consequences, computer programs are used to calculate the risk levels on a topological grid, after which they are used to plot contours of risk on the grid. These contours are used to display the frequency of exceeding excessive levels of hazardous exposure. For example, Reniers et al. [111] indicate the availability of software tools that will prepare contours, for example, for the frequency of exposure to nominated levels of heat radiation, explosion overpressure and toxic gas concentration. So-called quantitative risk assessment (QRA) software is used to plot FN curves.

One should keep in mind that all these software tools provide an insight into the possible scale of a disaster and the possibility of its occurrence, but they do not offer adequate information for the optimal prevention of catastrophic accidents. Moreover, if the number of events observed in the past is not sufficient to estimate significant frequency values, as in the case of type II events, a simple histogram plotting the absolute number of past events versus a certain type of consequence is often used instead of a risk curve. However, type II event predictions are extremely difficult to make, simply because of the lack of sufficient data. Although it is therefore not possible to take highly specific precautions based on statistic predictive information in such cases, engineering risk management leading to a better understanding of relative risk levels and to an insight into possible accident and disaster scenarios is essential to prevent such disastrous accidents and should therefore be fully incorporated into industrial activities worldwide.

From the previous paragraph, it can thus be argued [109] that the uncertainty about the events should be given much more emphasis in risk criteria and trade-offs. Actual outcome data from major catastrophes in modern society indicate that the desired risk levels are often not achieved, and that the actual outcomes have greater uncertainty and hence higher risk. Concrete examples are: the Concorde aircraft crash with over 100 fatalities over 27 years of operation; the Columbia and Challenger shuttle losses with 14 fatalities over an interval of 17 years between the flights; the Texas city refinery explosion with 15 fatalities over about 30 years of operation; the Chernobyl reactor explosion with 30 fatalities directly, and many more indirectly, over 30 years of plant life.

In any case, Sunstein [112] mentions that as the severity of an event increases, people become more risk-averse. In particular, once the death threshold is passed, it appears that the community has a much greater aversion to multiple fatality accidents. This is the reason why the aversion factor is often chosen to be higher than 1. The public in general is risk-averse, or, more accurately, consequence-averse, meaning that more severe consequences (with the same frequency) weigh heavier in the decision-making process than more frequent events (with the same total consequence).

In fact, there has been an ongoing debate about giving equal weight to the frequencies and consequences of accidents. By not distinguishing between one accident causing 50 fatalities and 50 accidents each causing one fatality over the same period of time of operation, one fails to reflect the importance society attaches to major accidents. Evans and Verlander [113], for example, claimed that the economic rule of constant utility (iso-utility) was violated by choosing an aversion factor higher than 1, and that therefore decisions made on any other criterion than the expectation value (EV) of the number of victims is wrong. However, recently Bedford [114] showed that an FN curve with an aversion factor higher than 1 is not risk-averse but consequence-averse, and thus no economic laws are violated. Nonetheless, as Ale et al. [107] mention, multiple fatalities can create greater disutility than single fatalities. Obviously, 30 people killed in a major explosion at a chemical plant operating for 20 years will lead to social debate and parliamentary enquiries, while the same number killed on the road in 20 days does not cause any societal ripple.

Linking the multiple fatality aversion with an economic analysis approach is rather difficult. This was demonstrated by the European Commission cost-benefit analysis results, indicating that the live-saving benefits of safety case regimes disappeared from view because the monetized value of life (VoL) (see Section 4.10.4) lost in major accidents was insignificant in comparison to other costs. Nonetheless, disasters can (and often will) result in multiple fatalities, and an economic analysis ignoring this fact is clearly problematic. Sunstein [112] therefore argues that preventing major accidents cannot be based on conventional cost-benefit analyses of lives lost. In fact, a rule of thumb is that 10 fatalities occurring at the same time are 100 (10²) times worse than one death, and 100 fatalities at the same time are 10 000 (100²) times worse than one fatality [115]. This can be translated into monetary values in the following way. Assuming that it is possible to put a value on human life (see Section 4.10.4 for more details), and that the value is €10 million, then the value of 10 lives lost at the same time equals €1 billion, and the value of 100 lives lost together equals €100 billion, and so on. By treating single fatalities differently from multiple fatalities for assigning monetary values, such a rule of thumb could obviously make a big difference in cost-benefit calculations. However, organizations should decide for themselves whether or not to use such a rule of thumb (or a similar one). In any case, it is a means to take into consideration the public's disaster aversion, and to recognize as a company that multiple deaths would affect society – and also the company itself – far more than the multiple would suggest.

Moreover, it is worthwhile mentioning a special case, i.e., the observation that several industrial activities from nearby companies in the same industrial area may each generate a low level of societal risk, each falling in the acceptable region, whereas their combined societal risk might fall within the high-risk zone (unacceptable region) of the chart in Figure 4.19, if these industrial activities were all to be grouped for the purposes of the calculation. As society places a special value on the prevention of large-scale loss of life, such multiple plant disasters should also be considered when carrying out economic analyses. However, this falls outside the scope of this book, which is concerned with operational safety economics within single organizations.

4.10.3 Economic Optimization

The relationship between risk criteria and an economically optimal situation can also be formulated as an economic decision problem, analogous to the method proposed by van Danzig [116] for flood defenses and by Jonkman et al. [117] for tunnel safety. In view of economic optimization, the total (hypothetical) safety benefits of a system (HB_tot) are determined by calculating the expected hypothetical benefits due to safety investment costs (SIC), that is, E(HB_SIC), and then subtracting these SICs (or expenditure for a safer system) from these expected hypothetical benefits. In the optimal economic situation, the total hypothetical benefits in the system are maximized:

Assuming that the SICs and the expected hypothetical benefits are both a function of a probability of loss, P_loss (e.g., the probability of dying combined with the probability of failure), it is possible to determine the optimal probability of loss of a system, subject to the condition of a predefined risk criterion. Moral aspects such as equity or justification of risk can then be taken into account in defining the risk criterion by the organization (see also Section 4.10.4).

For a thorough discussion of the SICs and the hypothetical benefits, see Chapter 5. When the probabilities of different accident scenarios are known, the expected hypothetical benefits can thus be assessed, and the optimal safety investments can be derived within the bounds of a predefined risk criterion. Obviously, although it is possible to take only material damage into the valuation problem, it is sometimes necessary, and therefore it should also be possible, to take the value of human life into the economic optimization problem. However, the valuation of safety and the valuation of human life both raise numerous ethical and moral questions, and they have been a subject of the safety literature for decades. The next section treats these sensitive subjects in more detail.

4.10.4 Moral Aspects and Calculation of (Un)safety, Monetizing Risk and Value of Human Life

4.10.4.1 Moral Aspects and Calculation of (Un)safety

This section on moral aspects and the calculation of safety, together with the next section on the monetizing of risks and the valuation of human life can be seen as the most difficult sections of the entire book. They are not difficult because of the mathematical formulae involved, but rather because the sections are highly complex due to the very important moral aspects interweaved with the questions of calculation of safety and valuation of human life. This ethical dimension may quickly turn into a philosophical discussion with very diverse viewpoints and opinions. Needless to say, the topic is highly debated, controversial, and sensitive to many people. That being said, a book on the economics of operational safety cannot simply omit or gloss over the moral aspects, or the valuation of human life, as something trivial in the calculation of safety. A thorough discussion and a viewpoint are thus needed. This section delivers just that.

As noted by van de Poel and Fahlquist [118], the psychological literature on risk perception has established that laypeople include contextual elements in how they perceive and understand risks (e.g., Slovic [104]). Such contextual elements include voluntariness, familiarity, dread, exposure, catastrophic potential, controllability, perceived benefits, and time delay (future generations). The fact that there is a difference in risk perception between laypeople and experts is often interpreted as the result of the irrationality of laypeople. However, such an interpretation indirectly assumes that the expert opinion, or the technical conceptualization of risk, is the correct one and that laypeople should simply be educated to the same viewpoint. However, Slovic [104] and Roeser [119, 120] explain that the contextual elements considered by laypeople are actually relevant for a better perception of the reality of risk, and are thus important for the acceptability of risks and for adequately managing risks.

Sunstein [121] notes that when asked to assess the risks and benefits associated with certain items, people tend to think that hazardous activities contain low benefits, whereas beneficial activities contain low hazards. Rarely do people consider an activity to be both highly beneficial and hazardous, or to be both benefit-free and hazard-free. Slovic [122] even suggests a so-called “affect heuristic,” by which people have primarily an emotional reaction to certain situations, processes, activities, products, and so on. It follows that emotions and feelings are essential elements to consider when dealing with operational risks and appreciating operational safety. Besides objective consequences and probabilities of potential scenarios, moral aspects (possibly fed by emotions) should thus play an important role in the calculation of safety. The subsequent activities of hazard identification, risk analysis (including estimation/calculation of consequences and likelihood), risk evaluation, and risk prioritization, the process known as risk assessment, only serve provide a rational idea of all the prioritized (rational) risks (for a certain scope of the safety study), in order to make decisions about what risks to deal with first, second, and so on (hence, safety budget allocations). However, to improve the safety budget allocation decision process, more than just rational risk prioritizations should be carried out; safety appreciation prioritizations should also be executed, where moral aspects are taken into account as well as the rational aspects.

If moral aspects were considered in the safety calculation process, economic analyses would perhaps be much less contested or debated, and more accepted as a valid approach to ensure that company policy is driven not by pure ratio or pure emotion, but by a combination of both, and thus a full appreciation of all aspects of safety, rational as well as emotional, is strived for. The risk thermostat, originally developed by Wilde [123] and adapted by Adams [103, 124, 125], can be applied to an organization, and the importance of balanced safety appreciations becomes immediately obvious in this regard. This is explained in the following paragraphs.

Everyone, including decision-makers in companies, has a propensity to take risks within appropriate limits. This propensity varies from one company to another and is influenced by the potential level of the rewards and losses arising from the organization's risk-taking decisions. Companies' so-called “perceptions of risk” are determined by the safety appreciations carried out in the company. Furthermore, companies' risk policies represent a balancing act in which the perceptions of risk are balanced against the propensity to take risks. Benefits and losses arise from an organization taking risks, and the more risks (in general, thus also the more operational risks) an organization takes, the greater the potential level of costs and benefits. Figure 4.22 shows this risk thermostat model applied to organizations.

The conceptual model illustrated in Figure 4.22 explains the impact of the safety appreciation process on the position of the company's risk policy balance. If moral aspects are not taken into consideration in the safety calculation, and, as a result, the costs from the company's risk policy are determined to be quite low (compared with the possible costs for the company if moral aspects were taken into account), the perception of a certain risk (e.g., a HILP risk) will be low, and the balance will tend toward risk-seeking behavior. In the case of type II risks, in particular, the risk thermostat conceptual model shows the importance of safety calculations taking moral aspects into account.

The literature ([126–130]) indicates the moral concerns that are often mentioned: voluntariness, the balance and distribution of benefits and risks (over different groups and over generations), and the availability of alternatives. These ethical dimensions can be used to enlarge the technical conception of operational risk, given in Chapter 2, in an extended formula of a “qualitative and quantitative” risk index, a so-called Q&Q risk index. The following formula for the Q&Q risk index (R*) is proposed to this end:

1

where

It is important to realize that the risk aversion factor a should be seen as a general factor for people with respect to their aversion to the consequences of risks, whatever the nature and background of the risks. The factors determining the acceptability, A, of a risk, however (i.e., F, E, and b), are risk-specific and depend on the nature and background of the risk. The factors E and F are also mentioned and defined by Rayner [131] in an early attempt to extend the well-known rational risk formula R = L × C. In the formula for an operational risk index that is proposed above, rationally calculated risk is combined with emotional aspects to determine a proxy for operational risk within an organization. E is a parameter representing the moral principle of “equity,” taking the emotions concerning the balance and distribution of benefits and risks into consideration. F is a parameter providing an idea of the moral principle of “fairness” or justification related to the operational risk of an event or scenario. Using this formula, the Q&Q risk index, R*, of an undesired event (or the risk of an event happening) is lower the more acceptable this event is, the higher the voluntariness of suffering the risk accompanying the event, and the lower the rationally calculated risk. As β and A are both dimensionless numbers, this R* index is expressed in the same units as rational risk. Hence, if rational risk is expressed in monetary units per time units (e.g., €/year), R* is also expressed in these units. The R* index could thus be used as an approach to calculate risk within an organization, using both the well-known rational data such as probabilities, consequences, and exposure, and the less frequently used moral principles such as fairness, equity, and anti-recklessness of management.

If company management wanted to use this approach, it would have to quantify the factors, E, F, a, and b. Notice that the parameters β, E, and F should be expressed as indices, and numbers for each of these parameters should be sufficiently different from each other to be relevant in the formula. A protocol within the company or within society should be designed to unambiguously determine the approach to quantify every parameter. Notice that if it were possible that a parameter β, E, or F could be chosen to be zero, then the R* level for the event would be infinite, and thus the event could never be made safe enough, whatever the safety investments to influence (lower) the likelihood and/or consequences. Therefore, this possibility is best excluded.

As an example, the following qualitative indices could be suggested for the parameters β, E, and F:

• Very low – 0.1
• Low – 0.5
• Medium – 1.0
• High – 1.5
• Very high – 2.0.

The parameters a and b are also suggested to be situated in the interval [0, 2], to avoid stressing the aversion factor and the anti-recklessness factor too much in the risk formula.

The index can then be used to fix a (maximum) company risk criterion for the probability of loss (see also the previous section) by determining the maximum probability for a certain (company-specific) Q&Q risk level (as given/fixed by the maximum number).

Clearly, this example should only be seen as illustrative, showing how moral principles might be integrated into risk calculation and hence influence safety decision-making with respect to the allocation of safety budgets. The rational risk calculations will always be very important to obtain a thorough idea of the real situation with respect to risk prioritization, but moral principles can help to give new and thorough insights into of the perceived situation with respect to risk prioritization.

4.10.4.3 Monetizing Risk and Value of Human Life

The risk thermostat model applied to organizations, explained in the previous section shows how operational safety decisions come about. An organization's balancing risk policy is assumed to seek an optimal trade-off between the potential benefits and the potential costs induced by the risk policy. There is one problem though: costs and benefits are numerous, various, multifaceted, and often considered incommensurable. There is no established or accepted theory about the balancing act of an organization's operational risk policy. There is, however, a large body of literature in economics on cost-benefit analysis that insists that decisions can be rational only if they are the result of mathematical calculation in which all relevant considerations have been rendered measurable; the common unit for measurements preferred by economists is money.

The next chapter treats cost-benefit analyses in depth, but it is useful to indicate in this section that there may be some problems with monetizing risk, as is sometimes required for determining the costs and the benefits associated with operational safety decisions. As Adams [103] explains, the purpose of cost-benefit analyses is to produce a Pareto improvement, if possible. A Pareto improvement is a change that will make at least one stakeholder better off and no one worse off. As any operational safety project that will produce this result is rare to nonexistent, economists commonly modify the objective toward producing a “potential” Pareto improvement. Hence, the purpose is then that the “winners” of the safety project compensate the “losers” out of their winnings and in such a way that they would still have something left over. In order to answer this question, there is a need to compare, in some way, the winnings and the losses, leading to the concept of risk monetization.

However, not everything can be translated directly into monetary terms, e.g., body parts or human life. For those matters that cannot be monetized directly, it is assumed that their valuation into money can be inferred from the values of those matters that can be monetized directly. However, there is a lot of controversy and debate surrounding this topic. Kelman [132], for example, argues that the mere act of attaching a price to a quality or condition changes it fundamentally. He reasons that unpriced values (e.g., a hand that is lost due to an industrial accident) provoke solidarity, as they are directly rooted in the feelings and experiences shared among social beings; by introducing prices (e.g., €50 000 as the price of a hand lost) these things are reduced to the level of commodities about which people are socialized to respond to individualistically and even competitively. This is on a societal level. In an organizational setting, however – which is the focus of this book – and with the aim to provide inputs into company decision processes about taking various safety actions to reduce risks, this argument can be challenged. In organizations, employees have the goal of making profits. Hence, every working day they trade off all kinds of operational risks against the profits that are made through the company's activities. It would therefore be irrational for employees to respond differently to a risk or opportunity that they know well and that they deal with day by day (thus systematically), just because a number is attached to it. Employees within an organization have chosen to work within this particular organization, to carry out specific tasks, and to implicitly accept the risks of the activities in return for a paycheck. Another argument is that people make decisions, but they also have decisions made for them. This may be true, but in an organization, if safety is calculated as explained before (using moral aspects) and people are treated from the point of view of respect and self-leadership, the monetization of risks is possible/defensible/allowed .

Another way of looking at this is that monetizing risks in an organizational setting is all about measuring preferences, not about measuring intrinsic values of operational safety. Economic values and intrinsic values are different. The use of a monetary standard in an organization is convenient and should be looked upon from a pragmatic perspective, i.e., it is employed to measure relative values (as opposed to actual values, because they are incommensurable). The question that organizations really want to answer by using risk monetization techniques, is as follows: Are the benefits (accidents avoided) following the taking of safety measures big enough to outweigh the operational safety investment decisions (costs of safety actions), or not? The answer may then be used as one (but, of course, only one) input to a decision process. As Wilson and Crouch [74] explain, in many cases, the comparison between risks is easy. The risk may be so large that once it is perceived, it needs action; this is the case if the risks are situated in the unacceptable region. In another case, the risk may be so small that it is not worth the trouble thinking about what actions to take; this is the case if risks are situated in the negligible region. Such cases are not worth highlighting as there is no controversy. Still other risks may belong to one of these two regions, but they may not be perceived in this way, due to there being no calculations or incorrect calculations/perceptions. The challenge for company decision-making, however, lies in the risks belonging to the ALARP region.

The coefficient for the equivalent of a monetary cost of a risk inevitably causes controversy, argument, and debate. When used by a company, it should, however, be regarded as an approximation to the organization's safety management's idealized safety utility function. By using such a coefficient, the goal is to obtain a measure of the utility of a risk by assigning a numerical value per unit of risk, usually expressed in monetary terms. Let's refer to this coefficient as gamma (γ). The coefficient does not need to be a constant, independent of the size and nature of the risk. This is explained in the following.

Consider a risk R to a company. The value of γ is determined by the level of the risk, which in turn depends on the circumstances. Thus, γ is function of R, implying it should be written as γ(R). Besides being consistent with theories accompanying utility models and models of perception, it can easily be understood. Let's assume that a company has a fixed safety budget to spend, and all factors in the risk calculation formula are constant except for the probability p. Consider a company faced with a major accident scenario probability of, for example, one in a million (10⁻⁶)/year. The company would be prepared to invest a certain amount of the available (fixed) safety budget in order to tackle the risk. In case of a larger risk, e.g. of a probability of 10⁻⁴, the company may be willing to invest a proportionally larger amount of the available safety budget (in the example, 100-fold larger), in exchange for dealing with the risk. However, if the risk were to become high enough, the limit of the available fixed budget that can be employed for safety investments might be reached, and the amount per unit of risk should logically decrease thereafter. Figure 4.23 displays this γ(R) curve.

All by all, every risk can be monetized in some way with finite resources (although they may sometimes be very high) and thus a fixed budget can be used – but there is one exception, human life, which is considered priceless. However, the figure changes when the budget is not fixed to a certain maximum amount. Replacing a “company” with an “individual,” and the “probability of a major accident scenario” with the “probability of dying,” the coefficient assigning a numerical value per unit of risk can be determined by asking people. The VoL or the value of statistical life (VoSL) is an extremely sensitive and much-debated subject. As the VoSL raises emotive feelings among many people, the concept is also often framed in terms of “the value of a life saved,” “the cost of a fatality averted,” or “the value of preventing a statistical fatality.” Nonetheless, as will become clear, efforts to quantify human life are always accompanied by inconsistencies and ethical concerns.

The value of a human life can be discussed in different ways. Obviously, a life is valued much more than the total worth of the various chemical elements composing a body. Dorman [133] indicates that from the time of Hammurabi (eighteenth century bc), attempts have been made to establish the “value” of lives of different classes of people, primarily for the purposes of punishment. A prince would be worth so many peasants in the harsh calculation of Hammurabian justice. In recent history, the most important reason for setting a value on life stems from the problem of establishing awards in wrongful death judgments. The reasoning goes that it is obviously not enough to demand reimbursement for the direct economic costs of dying (e.g., burial and funeral rites), as this does not cover the opportunity cost, i.e., the income that a deceased person would have earned had they lived on. The justice system therefore gravitated toward a procedure that came to be called the “human capital” approach: calculating the present value of the income stream foregone due to premature death. This approach uses the principle that the value of a person's life increases with earning ability and expected longevity, and decreases with age and the interest rate chosen for discounting. Leonard [134] cites cases dating back to 1916 in which expected future earnings were used to compensate wrongful death. As indicated by Dorman [133], this approach can be contested, as from a social viewpoint and the principle that every life should be equal, it is perverse to value citizens only in their capacity to produce. Moreover, there are many reasons for doubting that a person's income necessarily corresponds to their economic contribution to society.

But how can life then be valued? Economic theorists took up this question in the 1970s and 1980s and devised theoretical models based on the premises of expected utility theory. In particular, these economists were interested in the relationship between an individual's WTP for a reduction of the risk of early death and the extra earnings that reduction would make possible, in order to demonstrate the insufficiency of the human capital approach. The measurements that were used to test the theories were done by a process called “contingent valuation,” i.e., asking people. Indeed, the most straightforward approach to the complex problem of valuing changes in fatal (and non-fatal) risk would appear to be that of simply asking a cross-section of the population to state their own values.

In the case of operational safety, the way that people are asked is very important, as the monetary values that individuals place on a certain issue, and especially if that issue concerns human life, depend on how the question is posed. These are referred to as the “willingness to pay” and “willingness to accept” framing of the questions. The WTP refers to how much someone is prepared to pay to prevent a loss occurring, whereas the WTA refers to how much someone is prepared to accept in compensation for the loss of a benefit. In theory, the WTP value should be identical to the WTA value. In practice, it turns out that the WTA values are invariably higher than the WTP values, when individuals are asked to make preference choices. The key reason for this difference is an individual's preference to gain something rather than to lose something, as the negative impact of a loss is considered to be greater than the positive impact of an equivalent gain (cf. the theory on “loss aversion”; see also Section 4.1.3). Figure 4.24 shows that the values of WTP and WTA increase as the probability of the risk increases (when all factors in the risk calculation formula are kept constant, except for the probability p).

Figure 4.24 also illustrates that, if there is no maximum amount fixed, as the probability of the risk becomes very substantial it is plausible that no amount of money would be satisfactory. Jones-Lee developed a theory in 1989, improving on Dehez and Drèze [135] and Jones-Lee and Poncelet [136], based on the effect that changes in expected longevity have on the quality (not quantity) of potential life, which therefore sidesteps the confusion between accumulating years and accumulating utility. Jones-Lee's goal was to be able to quantitatively measure the lowest value of a risk increase consistent with an infinite compensation required to induce one to accept it, and the degree of risk aversion of an individual. In this way, it would be possible to construct a quantitative estimate for the required compensation to induce an individual to accept a certain risk increase. However, besides the differences in WTP and WTA values, there are other unique difficulties associated with the necessary measurements for determining the value of human life by asking individuals, such as, for example, in what narrative context such a demand makes sense, and how responses will change from one context (e.g., chemical industry) to another (e.g., cycling). Furthermore, if the probability of death is very low, people tend to assume that the adverse event will occur to someone else rather than to themselves, and their WTP value reflects this view (see also Fuller & Vassie [70]). Individuals' valuations of other people's lives also are likely to be lower than the value people put on their own lives. Valuations of life and people's WTP for improved control measures to prevent future loss of life also invariably increase after serious accidents (even if the probability of occurrence remains exactly the same). Moreover, when asking people, many respondents refuse to make such trade-offs, offering zero bids for risk reduction or saying that no level of compensation will induce them to accept an increase in risk. How does one interpret these refusals? And, as also indicated by Dorman [133], how much credence should be placed in responses to purely hypothetical questions, when respondents can simply throw out numbers with no apparent consequences for themselves and/or others? Finally, it is important to notice that valuations of life often vary between organizations, industrial sectors, and countries. These variations can be related to cultural and religious criteria, a company's ability to pay, the dread fear associated with some types of death, and the economic strength of different countries.

It becomes clear that there is no widely accepted method of measuring the VoL, and there probably never will be. But as it was settled earlier in this section that risk monetization is allowed and defensible, the question remains: how can averted fatalities be considered in decision-making for safety budget allocations in organizations?

In healthcare economics, the quality-adjusted life-year (QALY) is often used when trying to formally assess the value-for-money of a healthcare intervention. The QALY is a widely used measure of the burden of a disease, which includes both the quality and the quantity of life saved. It is based on the number of years of life that would be added by an intervention. Each year of perfect health is assigned the value of 1, down to the value of 0 for death. If extra years would not be lived in full health, for example, if the person were to lose a hand, or be blind, and so on, then the extra life-years are given a value between 0 and 1 to take this into account. There are some important drawbacks of the model, leading to the observation that it is hard, if not impossible, to employ in an organizational context. QALYs are designed for cost–utility analyses, and do not provide information on the valuation of life, for instance. Furthermore, QALYs require utility-independent, risk-neutral, and constant proportional trade-off behavior, all conditions that are hard to meet in organizational contexts. To use QALYs, organizations should also be able to assess the health states of their individual employees for possible safety investments they are able to choose from, which is most probably impossible. If one further considers the fact that perfect health is very hard to define, and that some health states may be worse than death (at least for a number of people), the meaning and usefulness of QALYs may be contested even more.

How can the averting of fatalities then be used to measure preferences for safety budget allocations? Let's return to the WTP attempts to value human life. Notice that WTP studies are used in the remainder of this section, because WTA studies are much less reliable than WTP studies due to the massive number of refusals to accept compensation in WTA studies. Based on a large number of value-to-life WTP surveys, different countries have put forward different values per statistical life, to be used, for example, in societal cost-benefit analyses. Table 4.10 provides some VoSL values found in a small selection of different countries.

Country	VoSL (approximate values) (€ millions)	References
Australia	3.0	Australian Government [137]
The Netherlands	5.8	IENM [138]
United Kingdom	2.4	HSE [139]
United States of America	7.0	DoT [140, 141]

All amounts have been recalculated to 2014 euros, for the purposes of easy comparison.

In fact, over recent decades, a large variety of studies have been carried out worldwide to determine the VoSL, and an equally large variety of values have been found. Research by Button [141] indicates that, at the time of the research, the official value of a human life varied between €12 000 and €2.35 million. In the cross-country paper by Miller [142], amounts vary between as low as US $40 000 in Bangladesh to as high as US $8.28 million in Japan (both in 1995 dollars). But Miller also shows minimum and maximum amounts of the VoL for individual countries, diverging substantially. Other studies mention other amounts (see, e.g., Sunstein [143]). Roughly, in current euro values, the amounts from the various studies range between around €50 000 to €25 million, if looked upon from a worldwide perspective. Hence, the variation between lowest and highest VoSLs is characterized by a factor of 500. Although the values are so different, it is possible to find some systematicity in the figures. In fact, Miller [142] shows that across countries, the average VoSL varies almost linearly with income. Hence, the so-called “human capital” approach was refused in part because it simply translated greater worldly success into a higher personal “worth” or value, but now the same results appear in the contingent valuation approach. But this should not be surprising, as any attempt to derive values from consumer demand in the marketplace will attach greater weight to the most affluent consumers. In other words, highly paid workers have a higher perceived VoL.

Nonetheless, the problem of using a VoSL in an organizational context can be solved. To use the VoSL in a company situated in a specific country, it is important to realize that, as already mentioned, the value is a relative one, and not intrinsic. This means that different values may be used by different plants belonging to one and the same organization, but situated in different countries. As the values need to be used in a relative way (to make decisions about budget allocation), all the other monetized risk values also depend on the country where the monetization exercise is carried out. Moreover, depending on the probability of the risk, a different VoSL might need to be employed. This is explained by Sunstein [143]. Instead of saying that “a VoSL value is €5 000 000,” for example, it would be more accurate to say that “for risks of 1/10 000, the median WTP, in the relevant population, is €500.” Or that for risks of 1 in 100 000, the median WTP value is €50. However, it is absolutely not clear whether people's WTP to reduce risks is linear. Suppose that people would be willing to pay €50 to reduce a risk of 10⁻⁵. Does it follow from this that people would be willing to pay only €5 to eliminate a risk of 10⁻⁶, or that, to eliminate a risk of 10⁻³, people would be prepared to pay €5000? Not necessarily. As the consequence remains the same (i.e., death), it is necessary to compare probabilities of death with one another to have an idea of how people perceive probabilities; i.e., do people display probability-seeking, -neutral, or -averse behavior? Notice at this point that it was already established that people are consequence-averse. Thus, they are, from a relative point of view, prepared to pay more for higher consequence risks (ceteris paribus). This was also discussed in the section on group risk: multiple fatalities count more than single fatalities (see Section 4.10.2.2).

People are very bad at dealing with probabilities, especially if they are extremely low (so-called type II risks). Nonetheless, if people were asked about their WTP based on explicit probability numbers, it may be assumed that they are rationally prepared to pay more for lowering higher-probability than lowering lower-probability type II risks. If this is the case, the VoSL for a 10⁻⁴ risk would have to be higher than the VoSL for a 10⁻⁶ risk. In fact, the VoSL figure is mostly used by agencies around the globe for the range of risks between 1 in 10 000 and 1 in 1 000 000. In Europe, for example, if a figure of €6 milion is used (e.g., in the Netherlands), it may be more optimal to use several figures: €8 million for risks of 1 in 10 000; €6 million for risks of 1 in 100 000; and €4 million for risks of 1 in 1 000 000. A minimum and a maximum amount would need to be fixed preferably between the 10⁻⁴ risk and the 10⁻⁶ risk, so that for risks of 1 in 10 000 000, for example, the VoSL would be €4 million in the Netherlands. In this way, it is possible for an organization to make budget allocation decisions in a relative way, and while using local economic information and taking both the probabilities and the consequences of risks into account.

Ale et al. [107] indicate that in the UK, such an approach, i.e., using a higher VoSL for risks close to the limit of intolerability, has been employed in the past. However, from the more recent amended Railways and Other Guided Transport systems (Safety) Regulations 2006, it seems that this difference is no longer used. Nonetheless, there is no reason – scientific or otherwise – given in favor of or against this approach.

4.11.1 Safety Investment Decision-making in the Case of Type I Risks

In the case of type I risks, it is possible to specify a concrete break-even safety point for each individual company. First the degree of safety pertaining to the company should be determined. As this degree of safety is relative to the other companies working in the same industrial sector, a defendable assumption would be that a 50% degree of safety corresponds to the LTIFR in the industrial sector of the country or region where the company is situated and that a maximal degree of safety of (100 − ϵ)% corresponds to a corporate LTIFR of 0. Remember from Section 4.6 that LTI frequency rates are used in the case of type I accidents as lagging indicators, and that the safety measured is thus actually “reactive safety,” so it might also be possible to see the degree of safety as some measure of “un-safety.” Nonetheless, for the sake of simplicity, it is called the “degree of safety.” Figure 4.25 illustrates a linear relationship between the degree of safety of a company and its LTIFR. Other linear relationships are possible and safety managers may thus use a company-specific relationship.

The illustrative relation from Figure 4.25 can be set out as follows:

wherein it is assumed that a minimum degree of safety is equal to (0 + ϵ)% (hence ) and wherein .

The model proposed is designed to help with objective investment decision-making for type I risks. In order to provide management decision-making with an objective input, the model should prove that a safety investment for type I risks, corresponding to the degree of safety pertinent to the enterprise, delivers the benefits expected. To achieve this, each company needs to specify in advance the desired break-even safety target ratio (or “BEST ratio”), defined by dividing the calculated expected hypothetical benefits (using definition (ii) of Section 4.2.4) by the SICs. This procedure resembles existing approaches in companies for determining the cost-effectiveness ratio (see also Chapter 6).

The BEST ratio should depend on the degree of safety determined for the company, in the sense that less safe companies (lower safety degree) are more in need of safety investments, and the SICs may thus, in a relative way, be higher than the expected hypothetical benefits for such low-safety companies, certainly when compared with safer companies (higher safety degree). For example, Table 4.11 can be developed and employed by a company safety manager.

By using a table such as Table 4.11, an enterprise can facilitate the attaining of its objective of an envisioned degree of company safety related to type I risks. Notice further that the relationship shown in Figure 4.25 does not need to be linear and other choices can be made by a company. Therefore, the overall working approach needs to be well considered in advance.

In order to obtain an objective comparison from a corporate point of view, the condition of achieving the BEST ratio can then be used to specify whether the safety investment is recommended or should be reworked. The model suggested in this section thus provides input for corporate management decision-making on safety investments for type I risks. Following an eventual reformulation of the safety investments as a result of applying the model (e.g., the model results in a ratio lower than the BEST ratio specified in Table 4.11), the economic exercise should be redone.

4.11.2 Safety Investment Decision-making for Type II Risks

In the case of type II risks, it is impossible to use LTIFRs to help decision-making, because they provide no information at all about the number of disasters (i.e., type II accidents) that have happened. Therefore, another approach of dealing with such risks needs to be elaborated and employed.

The technique that can be used, is expounded in the Section 5.7. The approach uses a so-called disproportion factor (DF; see Sections 4.11.2.1 and 8.12) and recommends, based on an organization's evaluation of the numerical value of the DF where the net present value (see Chapter 5) becomes zero, whether or not to invest in a prevention decision for type II risks. Hereafter, it is explained how the DF being considered acceptable/usable by the company can be determined, taking the FN curve (explained in this section) as well as societal concerns (Section 4.11.3) into consideration.

4.11.2.1 Disproportion Factor

Before giving more specifications about the DF, it is important to define the so-called proportion factor (PF), which is a term used to indicate the ratio of the costs to the benefits. The PF can then be compared with the numerical value of the DF in order to determine whether the risk reduction measure is “grossly disproportionate” or not.

If

it means that the safety investment is called “disproportionate” or “grossly disproportionate,” and a further risk reduction would be too costly if compared with the extra benefit gained from the safety investment. Hence, in such cases, it would be recommended not to do the investment.

Concerning the range of values that this factor can take, DF is necessarily greater than 1 because otherwise it would mean a bias against safety (or in favor of “un-safety”). According to Goose [144], the value of the DF is rarely over 10 and should never be higher than 30.

Theoretically, the DF is higher when the risk increases and is infinite when the risk level reaches the intolerable region, meaning in fact that the risk must be reduced no matter the cost.

4.11.2.2 Numerical Estimation of the DF

A scheme of calculation has been suggested by Goose [144], using three intermediate factors, called the “how factors,” which, when multiplied together, give an estimation of the value of the DF. They are referred to as “how bad,” “how risky,” and “how variable.” They are calculated through the use of three values which can be extracted from an FN curve (see Sections 4.10.2.2 and 8.12). These values are as follow:

1. 1. the sum of the failure rates, expressed in events per year ();
2. 2. the “EV” which is sometimes also called potential loss of life and represents the average number of casualties expected per year;
3. 3. the maximum potential fatalities (N_max), which is the worst-case scenario concerning the number of fatalities for a single event;
4. 4. a fourth value can be calculated with the ratio of EV to , representing the average number of fatalities per event (N_av).

It should be noted that this method is based on fatality risk alone and the factors are not fully independent, which introduces non-linear weighting. For example, harm is counted twice in the first two factors.

There are different calculation models developed by Goose [144]. Only the “suggested method” by Goose will be explained further. The approach to calculate the three “how” factors is as follows. The “how bad” factor represents the effect of , the average number of fatalities per event, on the DF:

The “how risky” factor represents the effect of EV, on the DF:

The “how variable” factor represents the effect of the ratio on the DF:

The DF is then computed by multiplying the “how” factors and adding 3 (dimensionless) to this product:

2

4.11.2.3 Hypothetical and Illustrative Example of the Calculation of an FN Curve-based DF

In this example, the goal is to show how an FN curve is plotted and how in practice it is possible to extract the three values necessary to estimate the DF from the curve. A hypothetical example will be used in order to illustrate the subject. Throughout the example, N will represent the estimated number of fatalities in each event and f will represent the frequency of each event. Before beginning, care should be taken that there are not different values of frequency corresponding to the same N. If this were the case, a simple addition for each frequency of the same N would solve this issue.

As explained in Section 4.10.2.2, an FN plot is used to present societal risks and plots the cumulative frequency F as a function of the number of casualties N. F is the sum of frequencies of all events where the outcome is N or higher. Data are recovered from records of historical incidents or from quantitative risk analysis. Conventionally, a log–log plot is used because of the wide range of values for F and N.

Step 1. Plotting the FN Curve

In order to plot an FN curve, the fatalities have to be sorted in decreasing order and therefore N_max becomes the first input in the table. A possible presentation of the data is shown in Table 4.12 and an example of an FN curve once it has been plotted is shown in Figure 4.26.

Events	Event frequency f (per year)	Event outcome N (number of fatalities)	Cumulative frequency
1	0.000 005	13 000	0.000 005
2	0.000 1	4 600	0.000 105
3	0.000 5	540	0.000 605
4	0.01	44	0.010 605
5	0.02	27	0.030 605
6	0.08	1	0.110 605

Step 2. Extraction of Useful Data

The goal at this point is to find the value of , EV, and N_max in order to use them to calculate the DF. These data can be derived from Figure 4.26, as illustrated in Figure 4.27.

In Figure 4.27, it is possible to see how to graphically extract the first 2 values and N_max. In this case: and , Table 4.12.

The extraction of the EV is more difficult because theoretically it is the frequency-weighted average of the casualties:

with N_i and f_i the number of casualties and frequency of each event.

It is possible to see in Table 4.13 how to correctly calculate the EV from a data table. Unfortunately, an FN curve is rarely given with its corresponding data table. However, the EV can also be seen as the area under the curve, which is useful, and the reason stems from the fact that when there is a lot of data available, the following equation is true:

with F(N_i) the cumulative frequency for each event.

Events	Event frequency f (per year)	Event outcome N (number of fatalities)	Expectation value for each event EV
1	0.000 005	13 000	0.065
2	0.000 1	4 600	0.46
3	0.000 5	540	0.27
4	0.01	44	0.44
5	0.02	27	0.54
6	0.08	1	0.08
Sum of the values gives total expection value = 1.855

Step 3. Calculating the Disproportion Factor

The three options for the DF assessment will be dealt with separately and results will be gathered at the end. Table 4.14 sums up the data which will be used all along the estimation.

Cumulative frequency	Expectation value	Nmax	Nav	Nmax/Nav
0.110 605	1855	13 000	17	775

Therefore:

Hence, (Eq. (2)):

4.11.3 Calculation of the Disproportion Factor, taking Societal Acceptability of Risks into Account

In 1978, Fischhoff et al. [145] described a psychometric study in which it was demonstrated that feelings of dread were the major determinant of public perception and acceptance of risk for a wide range of hazards. A psychometric questionnaire was used in order to correlate nine characteristics of risks, resulting in two main factors. The factor “dread risk” included the following items: perceived lack of control, catasrophic potential, inequitable distribution of risks and benefits, fatal consequences and dread. The “unknown risk” factor consisted of the items observability, experts' and laypeople's knowledge about the risk, delay effect of potential damage (immediacy) and novelty (new-old).

In a study by Huang et al. [146], the goal was to find correlations between public perception of the chemical industry and its acceptance in the matter of risks. Based on a survey administered from 1190 participants, four different factors related to social acceptance were found, each one being subdivided into two sub-factors. The first factor, “knowledge,” consisted of a newness factor and a knowledge factor. The second factor, “benefit,” consisted of the benefit and immediacy together. “Effect” was matched with the third factor and divided between social effect and dread. Finally, “trust” included controllability and trust in governments.

The four factors were then linked with social acceptance through a regression analysis. It is important, however, to specify that knowledge should be understood from the perspective of citizens and that the social effect actually implies “How many citizens are exposed to the risk?” Moreover, the factor “trust in government” also concerns policymakers in a broader sense.

In a study by Gurian [147], the focus was more on how risks are perceived and considered by the general public and society, rather than focusing on the industry's point of view. Based on theoretical explanations, Gurian [147] defined three factors that influence risk perception. The first one, “dread,” included gut-level (related to intuition), the emotional reaction due to risk, threat to future generations, control over the risk, equitability and catastrophic potential. The second factor, “familiarity,” comprised delayed effects, newness, understood by science or not, and encountered often by the public or not. Finally, the last factor was about the “number of people exposed to the risk.”

Adams [148] used the risk thermostat model to describe the perception of risks and, again, a new classification of risks is given depending on three main factors: voluntariness, individual control, and profit-motivated. The acceptability model developed by Adams and resulting from the risk thermostat model is shown in Figure 4.28.

This study is very similar to those of Gurian [147], Fischhoff et al. [145] and Huang et al. [146], as it focused on the perceived levels of risks to laypeople.

A study by Baker and Dunbar [149] takes societal concerns into account from a risk managers' point of view. The Baker model can be seen as an adaptation of a previous study by Mansfield [150]. Mansfield's more complex model describes a variety of societal concerns in the decision-making process. Baker and Dunbar [149] constructed a systematic framework for the Rail Safety and Standards Board (RSSB), which helped to determine the extent of societal concern in specific cases. They even mentioned that they believe a systematic framework is required so that the factors that have been considered in any facilitated evaluation are completely transparent. However, this model is focused on the transport and rail industry and cannot be used directly for industry in general.

Figure 4.29 shows how the model is structured with the six high-level concern factors. As found in several studies, they use spider diagrams to present the results, which make for an interesting visual representation.

In a study by Sandman [151], the goal was to develop software that allows a prediction and management solutions to deal with what they call “outrage,” which is closely related to the notion of societal acceptability. Sandman defined risk as the sum of hazard and outrage, with hazard being the standard, well-known term used by risk managers (hazard = magnitude × probability) and outrage being related to the public's perception of risk. The idea is that risk assessors see risk only as hazard, e.g., only with the expected annual mortality, whereas the public sees it as a combination of hazard and outrage. Twelve outrage items are then given and can be described in this case using two words at a time. The first one stands for lower chances of outrage and the second for higher chances of outrage: voluntary versus coerced, natural versus industrial, familiar versus exotic, not memorable versus memorable, not dreaded versus dreaded, chronic versus catastrophic, knowable versus unknowable, controlled by us versus controlled by them, fair versus unfair, morally irrelevant versus morally relevant, trusted versus not trusted, and responsive process versus unresponsive process.

4.11.3.2 Factor Analysis and Resulting Classifications of Relevant Factors

In order to classify the different indicators, a factor analysis was conducted, the results of which led to the development of the scoring system that follows [153]. The purpose of the study was to examine the factor structure of the societal acceptability of risks (SAR) scale [153]. The first factor consisted of four items (note that the “items” are refereed to as “indicators” in the previous section) and explained 24.73% of variance, the second and third factors each consisted of three items, explaining 11.78% and 10.10% of the variance, respectively, and the fourth factor consisted of only one item that explained 9.61% of the variance. Factor I (four items) consists of items related to the awareness of the company of the risk and fairness of dealing with it; factor II (three items) consists of items related to trust in risk bearers; factor III (three items) consists of items related to the characteristics of the major hazard and its consequences; and factor IV refers to trust in safety management. Figure 4.30 illustrates the results of the confirmatory factor analysis.

The factors presented as relevant have therefore been sorted and included into a scoring system which is explained in the following. The classification of each indicator into the main factors (F_I, F_II, F_III, and F_IV) has been done depending on their order of consistency in the factor analysis, but the same weight in the scoring system has been applied in the end due to small differences between them.

4.11.3.3 Scoring System Development

Level of Societal Concern

The model developed in this section is a scoring system that can be filled in directly by safety management, e.g., by board members of a safety committee from the point of view of assessing societal concerns that might arise before or after an accident occurred, and that may thus be important when deciding on safety investments. The idea is therefore to try to picture how workers in a company or outsiders might view the safety management setup in their workplace and what kind of concerns they might have. There are, indeed, cases where the costs due to a strong public reaction were very high. This system therefore identifies, from the perspective of the company managing the hazard, the potential factors influencing this type of situation.

The different factors as listed in the previous section can be grouped into subcategories. Ideally, each subcategory tackles a “key idea” of SAR. As the standard calculation of the DF as proposed by Goose [144] already takes into account the maximum number of casualties (N_max) and the average number of fatalities per year (EV) and per event (N_av), these factors (which are often described as the severity of consequences) should not be considered again in the model that is being developed. As already explained, the goal of the model is to offer an approach regarding how to include moral aspects in the DF, taking societal acceptance of major hazards into account for the industrial sector in general. It therefore incorporates each relevant factor into a scoring system that gives the global level of concern as an output. Depending on the level of societal concern, the DF is then modified accordingly.

Furthermore, the developed model needs to be designed keeping in mind that it should always possible to use a neutral score for each question. This implies that if one scores between 0 and 4, e.g., 2, this should indicate some kind of neutrality. In this way, it is possible for the user of the scoring system to “skip a question,” e.g., if the indicator seems inappropriate or it does not fit the considered case.

F_I (Four Indicators) – “Awareness of Company about the Risk and Fairness of Its Management” (16 Points Maximum)

1. F_I-1 – History of the risk itself for the risk bearers

   The indicator “history of the risk itself for the risk bearers” questions whether there were recent accidents involving the same hazard. (And is it relevant, meaning can people still recall this event?) It can be seen also as previous accidents drawing a lot of media attention or strong protests.

   The score that needs to be given by the user of the scoring system for calculating the DF* varies from 0 (which corresponds to hardly any records of accidents of the same type) through 2 (neutral score) to 4 (corresponding to many records of accidents of the same type).

2. F_I-2 – History of bad advice

   The indicator “history of bad advice” is a reflection of whether the company has had a large-scale industrial accident before, which it can be assumed is still in the risk bearers' memory.

   The score that needs to be given by the user of the scoring system for calculating the DF* varies from 0 (which corresponds to excellent safety records for the company) through 2 (neutral score) to 4 (corresponding to poor safety records for the company).

3. F_I-3 – Fair allocation of risks and benefits

   The main idea of this indicator “fair distribution of risks and benefits” is to determine whether the risks and benefits are fairly distributed among the risk bearers and the risk beneficiaries. In fact, the aim is to avoid cases of moral hazards when one person is willing to maintain a risky situation because he or she does not bear the consequences and only has the benefits.

   The score that needs to be given by the user of the scoring system for calculating the DF* varies from 0 (which corresponds to a fair distribution of risks and benefits) through 2 (neutral score) to 4 (corresponding to an unfair distribution of risks and benefits).

4. F_I-4 – Common-dread

   The indicator “common-dread” questions whether the risk bearers are able to reason in a rational way when facing the hazard/situation. Is it possible that risk bearers have a great sense of dread that would influence their reaction? The idea here is to determine the level of fear of harm or the level of emotional “gut reaction.” It can also be seen as a possibility of dramatization of the risk by the public.

   The score that needs to be given by the user of the scoring system for calculating the DF* varies from 0 (corresponding to a hazard that is not very frightening) through 2 (neutral score) to 4 (corresponding to a great sense of dread associated with the considered hazard).

F_II (Three Indicators) – “Trust in Risk Bearers” (12 Points Maximum)

1. F_II-1 – Individual control over the hazard/situation

   The indicator “individual control over the hazard/situation” tries to capture the level of personal control over the situation for the person exposed to the risk. It can also be seen as the availability of alternatives when facing the hazard. With this factor, the possible response skills of the risk bearers can be evaluated.

   The score that needs to be given by the user of the scoring system for calculating the DF* varies from 0 (which corresponds to total control for the individual) through 2 (neutral score) to 4 (corresponding to no control at all for the individual).

2. F_II-2 – Lack of personal experience

   The indicator “lack of personal experience” verifies whether there is a lack of personal experience among risk bearers for the considered risk. In fact, if risk bearers have personal experience with the risk/situation, the risk is more likely to be accepted.

   The score that needs to be given by the user of the scoring system for calculating the DF* varies from 0 (which corresponds to a lot of experience for the individual) over 2 (neutral score) to 4 (corresponding to no experience at all for the individual).

3. F_II-3 – Uncertainties: public's point of view

   The indicator “uncertainties: public”s point of view' can be seen as the public's knowledge of the considered risk, i.e., how much does the public at large, or more specifically the risk bearers, know about the hazard? Is it well known by the public? Can people easily understand this risk? It can also be seen as the accessibility to reliable information.

   The score that needs to be given by the user of the scoring system for calculating the DF* varies from 0 (which corresponds to easily known by the public) through 2 (neutral score) to 4 (corresponding to great uncertainty or a complex hazard that is difficult to understand).

F_III (Three indicators) – “Characteristics of the Major Hazard and Its Consequences” (12 Points Maximum)

1. F_III-1 – Uncertainties: science point of view

   The indicator “uncertainties: science point of view” can be seen as the experts' knowledge and agreement concerning the studied hazard. How much does science know about the risk? Is it well known by the technical community? Do experts agree on how to manage the risk?

   The score that needs to be given by the user of the scoring system for calculating the DF* varies from 0 (which corresponds to perfectly known by the technical community) through 2 (neutral score) to 4 (corresponding to great uncertainty or no agreement at all among scientists).

2. F_III-2 – Environmental impact

   The indicator “environmental impact” assesses whether the hazard could have a (major) environmental impact or not. For example, a chemical leak into a river or a radioactive fallout could have a major impact upon perception of the risk.

   The score that needs to be given by the user of the scoring system for calculating the DF* varies from 0 (which corresponds to no environmental impact) through 2 (neutral score) to 4 (corresponding to tremendous environmental impact).

3. F_III-3 – Man-made vs natural causes

   The main idea of the indicator “man-made versus natural causes” is to determine whether the accident could be caused by human error or natural causes. Human error (score 2) includes, for example, a miscalculation of the resistance of a physical barrier or a mismanagement of the risk. A plane crash as a result of a storm is an example of a neutral score.

   The score that needs to be given by the user of the scoring system for calculating the DF* varies from 0 (which corresponds to purely natural causes) through 2 (neutral score) to 4 (corresponding to purely human and/or technical causes).

F_IV (One Indicator) – “Trust in Company's Safety Management” (Four Points Maximum)

The indicator “trust in the company” (which in this case is also the factor) indicates to what extent it is believed that the people exposed to the risk (or the citizens most likely to criticize company policies) trust the company's risk management abilities? The main idea of this factor is to take into account the perception of risk bearers regarding the company's safety management.

The score that needs to be given by the user of the scoring system for calculating the DF* varies from 0 (which corresponds to a complete trust in management practices) through 2 (neutral score) to 4 (corresponding to a complete mistrust in management practices).

Effective Use of the Scoring System – Calculation of DF*

Different factors can determine whether or not societal concerns might arise from a situation. A value needs to be assigned to each indicator, so that a value is determined for each factor, eventually providing a corresponding weight factor in the equation to calculate the DF*.

However, suitable ranges of values need to be carefully chosen so that the original DF does not change too much. In fact, the idea is to have slight modifications of the value calculated with the economic model developed by Goose [144]. The estimated level of societal concern (low, neutral, or high) should merely be an indication of the value of the weight factors applied to the DF in order to give the modified DF*. This specific point has been verified by a sensitivity analysis that is described in the next section.

In the following model, the user should bear in mind that the advised range of values given by Goose [144] for the DF remains between 3 and 30 (DF ∈ [3;30]). It is possible to imagine a case where high societal concerns could raise the DF over 30, but that should only happen in very specific cases.

An Excel document can be created for this purpose, containing all the necessary calculations on a unique spreadsheet and therefore allowing direct use of the scoring system. The factor table summarizing the layout for each factor and indicator in the Excel document is presented in Figure 4.31. It is important to point out that the model described in what follows should only be considered as a guidance tool. It should therefore be seen as a suggestion and not as the only possible way to do it.

A separate spreadsheet can be created with the weight factors that should be applied depending on the total score for each main factor. An example of how the weight factors are chosen is given in Figure 4.32.

It should be noted that a choice needs to be made concerning the possible negative impact of this kind of assessment. It has been supposed that social impacts are rarely in favor of a company, especially in industry. That is why it is impossible to reduce in this model the value of the DF with a weight factor lower than 1.

The final step is then to multiply the initial value of the DF by the four weight factors (WF_i) as described in the following formula:

Discussion of the Suggested Scoring System

The scoring system described is one that may be used by risk managers so as to include the SAR in economic analyses of industrial risks. It is quite easy to understand and to picture each of the parameters included in the model, and especially how it works as a whole. It is also flexible in the sense that it can be adapted to different situations. Specific parameters can even be chosen as neutral so that they have no impact on the final outcome. Finally, the scoring system is complete in the sense that all the indicators known to be influential for the SAR and relevant within the framework of the prevention of major industrial accidents have been included and weighted according to their importance.

Disadvantages of this model include the subjectivity introduced by the fact that users are free to change some of the parameters and to apply different weight factors depending on the desired sensitivity and the final impact on the DF. Another item of concern is that this model still needs risk managers who are ready to take the leap and include it in economic analyses of their organizations' risks.

The scoring system allows the user to assess the level of societal concerns by identifying situations where public outrage could spill over. It also provides guidance about the main factors influencing societal acceptability along with a means of including it in the previously developed DF model (based solely on the numbers of fatalities and the FN curve) thanks to weight factors. In fact, 11 indicators have been identified, explained and grouped into four main factors.

Regarding further adjustments, it is possible to imagine, for example, the development of actual software with an interface that would make it even more user-friendly and with an extensive database that would allow access to information and good descriptions of the terms or the context. It could provide details about every parameter, but also information on specific cases, and give examples of how to solve certain issues related to this topic (e.g., trust improved with better risk communication, or knowledge of workers increased with awareness campaigns).