Primary navigation:

QFINANCE Quick Links
QFINANCE Reference

Home > Operations Management Best Practice > Managing Operational Risks Using an All-Hazards Approach

Operations Management Best Practice

Managing Operational Risks Using an All-Hazards Approach

by Mark Abkowitz

Getting Started

A key first step is for your organization to have an ORM physical, essentially a comprehensive review of how operations are performed, what risks are present in performing these operations, and how these risks are presently being managed . This engages the organization in identifying “reasonably foreseeable” risks, benchmarking the current status of the existing ORM program, identifying program gaps where the organization carries the greatest liability, and suggesting strategies and tactics that can be implemented to close these gaps. Having a risk physical is important regardless of whether the organization’s ORM program is relatively new or fairly mature.

Case Studies

ORM Failures and Successes

There are several historic events that bring the failures and successes of operational risk management into focus. How could the event have been prevented? What could have been done to mitigate the impacts? What management controls have been implemented since the event occurred? Could it happen again? These are all legitimate ORM questions that, through hindsight, allow us to learn from experience and apply these lessons to deploying more effective ORM in the future.

Hurricane Katrina

During August 2005, Hurricane Katrina slammed into the United States, hitting the coastal areas of Florida, Louisiana, and Mississippi. A combination of storm surge, wave action, and high winds resulted in the destruction of buildings and roads in the affected areas. The impact of Katrina on New Orleans was unusually severe; portions of the city were left under 20 feet of water due to failure of the earthen levees and floodwalls that had been constructed to safeguard the city from this type of event. Hurricane Katrina caused nearly 2,000 fatalities and an estimated economic loss of $125 billion, in addition to displacing hundreds of thousands of people from their homes and workplaces. The destruction and loss of life in New Orleans, while initiated by the storm itself, cannot be attributed entirely to Katrina. Numerous failures of the city’s flood protection system due to poor design and construction, deferred maintenance, and a lack of funding left New Orleans susceptible to a hurricane of Katrina’s magnitude. As the city filled with water, the hurricane’s effects were compounded by insufficient emergency planning and preparedness, and the inability of responders to communicate.

Alaska Pipeline and Denali Earthquake

A major earthquake struck the Alaska mainland on November 3, 2002, along the Denali fault, which passes directly under the Trans-Alaska Pipeline. Had the pipeline ruptured, it would have resulted in spillage of up to a million barrels of crude oil a day in an environmentally sensitive area. Yet not a drop of oil was released. This potential catastrophe was averted due to successful ORM in both the design of the pipeline system and the quality of the maintenance, surveillance, and emergency preparedness. The pipeline design team, using extensive field data, devised a system such that it could survive a major earthquake should one occur during the pipeline’s projected 300-year operating period. As a result, a $3 million up-front investment in geological studies and corresponding design considerations helped to prevent an environmental disaster that could easily have topped $100 million in remediation costs. Concurrently, a comprehensive surveillance and maintenance system was implemented, capable of identifying problem locations in real time and dispatching crews accordingly. Moreover, emergency response was facilitated by a well-organized incident command system, contingency planning, and a training program.

Making It Happen

  • Designate ORM as a core business practice within the organization by establishing the program at the vice-president level. The VP should be responsible for defining ORM policies and procedures, and for providing oversight of program activities.

  • Organize an ORM committee, which reports to the VP, with membership that includes representatives from each element of the organization that has a designated ORM responsibility.

  • Perform an ORM physical, and use it as a basis for defining program priorities, allocating resources, and implementing management control strategies.

  • Monitor and evaluate ORM performance to determine whether program objectives are being met.

  • Maintain ORM as a living process that is part of the culture of the organization.


We can ill afford not to recognize the new age of operational risk management, one based on a holistic and systematic approach to identifying reasonably foreseeable risks, establishing priorities, and adopting practical, achievable, and cost-effective control strategies. As history has taught us, we remain vulnerable to the occurrence of catastrophic events whose prevention or mitigation is within our control. Moreover, changing conditions in our world are posing new challenges that will require making tough risk-related choices. Adopting an all-hazards ORM approach does not mean that we will never suffer another tragedy. However, the prospect of that happening is less likely to occur once investments in prevention and mitigation have been made. The bottom line is that we can, and should, do much better at being a master rather than a victim of risk. All it takes is a more organized approach to takes is a more organized approach to managing the risks that affect our daily lives, coupled with a greater tolerance for unfortunate events that will sometimes occur no matter how hard we try to avoid or prevent them.

Back to Table of contents

Further reading


  • Abkowitz, Mark D. Operational Risk Management: A Case Study Approach to Effective Planning and Response. Hoboken, NJ: Wiley, 2008.
  • Garrick, B. John. Quantifying and Controlling Catastrophic Risks. San Diego, CA: Elsevier, 2008.


Back to top

Share this page

  • Facebook
  • Twitter
  • LinkedIn
  • Bookmark and Share