ALARP (As Low As Reasonably Practicable)

A fundamental principle of risk management

Citation
, XML
Authors

Abstract

ALARP is the level of risk that is tolerable and cannot be reduced further without expenditure of costs disproportionate to the benefit gained or where the solution is impractical to implement.

ALARP is one of the fundamental principles of risk management. We neither need nor want to manage risk to the point where we eliminate it, because doing so is simply not a good use of resources.  The ALARP concept is illustrated below and is the point where risk is negligible, or at least at a level where it can be managed by routine procedures.
Cost / Benefit of Risk Mitigations

The majority of risks we face are already at this ALARP level and we accept them relatively unconsciously. For most of us in our everyday lives, the risk of being pick-pocketed is so low, that we don’t feel the need to carry cash in separate pockets or hidden moneybelts. We similarly manage slightly higher risks, such as crossing the road, by routine procedures that we were taught as children.
One of the key challenges with ALARP is that it is inherently a subjective standard. I will always come down to our ‘values’. For example, if an organization places a value of $1,000,000 on a human life, then anything which is likely to safe one life per year and costs $2,000,000 per year to implement won’t get implemented if we apply the ALARP principle.  If a regulator however fines an organization $5,000,000 following a fatal accident, then the ‘value of a human life’ has just risen to $5,000,000 so the $2,000,000 risk treatment is obviously worth implementing.  
Or is it?  If the organization has only $1,000,000 available (counting both debt and equity), it may simply decide that it will be bankrupt in any case and choose to take the risk that no fatality will occur. Just to make it more complex, consider if the organization chooses to spend $10,000 on a consultants report which indicates that some simple administrative changes costing only $100,000/year will achieve the same objective.  This completely changes the ALARP equation in favor of spending the $100,000 but it also means that a cheaper risk treatment had previously escaped identification. If this cheaper risk treatment was only discovered post-fatality by a coronial enquiry (with perfect 20/20 hindsight as always) then the ALARP standard can (and should) become grounds for punitive measures.   
Four things that are worth saying about ALARP:
  • it’s driven almost totally by values
  • it takes significant analysis to determine how to get into the ALARP range (and to tell when you are there)
  • it needs some kind of risk management benchmarking or performance measurement to tell if risk management is moving us towards or away from ALARP
  • ALARP is all about trade-offs. There is no perfect ‘ALARP’.
ALARP = the trade-off between resources and risk

To illustrate this last point, consider another view of the ALARP principle in the illustration above. The balance point or trade-off between risk mitigations and risk exposures, produces a point of equilibrium. To sum up: ALARP is the level of risk that is tolerable and cannot be reduced further without expenditure of costs disproportionate to the benefit gained or where the solution is impractical to implement.
So far so good?  Yes… until you consider that the international definition of risk (“the effect of uncertainty on objectives”) according to ISO31000 Risk Management Standard, includes both positive and negative outcomes. Hence under this definition, there are a range of outcomes that we actually want to make As High As Reasonably Practicable. My proposed suggestion is that we trade ALARP up to a newer model: AHLARP (As High / Low As Reasonably Practicable).  More on that at http://31000risk.blogspot.com/