The Incident Database – The Reverse Risk Register

Many organisations maintain an incident database to record the incidents that occur. What I have observed, however, is that the incident databases are not being used to their full effect in that there is no linkage to the risk register.
This blog will describe why the linkage is so important and, how to get the most out of your incident database.

The importance of linking the incident database to the risk register

The linkage between an incident database and a risk register can be summed up quite simply: an incident is a realised risk. And herein lies the irony: where I have reviewed incident databases in organisations, for the most part, the incident that has occurred has not been in the risk register.

My view: an incident database is a reverse risk register.

I was engaged to assist in the development of a risk register for a childcare centre. In preparation, I simply typed “childcare centre incidents” into an internet search engine. One of the documents that came up in the search was a report into childcare incidents in an Australian state for the previous 12 months. There were several thousand incidents, but, when looking at them more closely, trends began to emerge. As an example, there were several incidents where a bookcase had fallen on a child; others where a television had fallen on a child; some where a tree branch had fallen. Rather than capture each of them as specific risks, the risk I settled on was: heavy item falls on child.

This, therefore, was a risk that I would have expected to find in the childcare centre’s risk register, however, like so many of the registers I see, it was full of causes and consequences – not the actual events that the organisation is attempting to prevent.

What should be captured in an incident database

Obviously, the incident database should capture all of the details of the incident, including all of the material highlighted in Risk Tip #10, but there are a couple of key pieces of information that turn an incident database from being simply a repository of data to being a powerful tool that can be used for decision making.

Linkage to a risk in the risk register

As stated previously, an incident is a realised risk, so, therefore, the first requirement is the ability to link the incident to a risk in the risk register. As an illustration, if there was an incident within our childcare centre where a bookcase toppled over onto a child (or there was a near miss), there should be a drop-down option to select the risk: heavy item falls on child.

The linkage to a risk forms two purposes:

• Firstly, the linkage can be used to report the number of instances where that risk has materialised; and
• Secondly, and more importantly, it can be used as a means to validate the information in the risk register in relation to control effectiveness. The control in the risk register may be assessed as effective, however, repeated incidents where a failure of that control has contributed to the incident may indicate it’s not as effective as assessed.

Linkage to consequence matrix

When a risk is captured in the risk register it is assessed for consequence against all of the impact categories.  What is not captured, however, are the actual levels of consequence in comparison to the organisation’s consequence matrix.

Let’s imagine that we have a risk in the risk register: worker or member of the public trips, slips or falls in the workplace.  The assessment of consequence in the risk register is as follows (noting that this is a realistic assessment based on countless risk registers I have reviewed):

Let us further imagine that over a period there are 100 incidents and the actual consequences are as follows:

Surely, based on the consequences that have actually been observed, there is no justification to maintain the current consequence levels in the risk register.

Summary

For me, one of most important functions of the incident database is to serve as a bulls&%t meter for the risk register.  So, the linkage between the risk register and the incident database, is absolutely critical and provides the ability and necessary information to make risk informed decisions with an honest perspective and transparent context.