Purpose of the operational risk response analysis
10. An operational risk response analysis (ORRA) is used to identify risks and plan mitigation actions for an emergency response. It provides a detailed analysis of the risks to consider when designing, delivering and managing the day-to-day operational response.
20. The ORRA and the associated risk response plan are integrated into existing monitoring activities within the overall emergency operational plan and management process.
30. The activities that require a more detailed analysis of risk responses and are included in the ORRA are set out in the emergency response procedures. Risks are generally grouped around the incident management system (IMS) functions.
40. Risk analysis and risk response planning consider and assess foreseen challenges based on the following:
- their likelihood of occurring at the current time and within the current context; and
- their scale of impact on key areas of the response, such as the following:
- response delivery and quality
- safeguarding and ethics
- financial stewardship
- partnerships and reputation
- staff safety and well-being.
50. After a risk is identified and assessed, delegated staff decide whether to respond to the risk by tolerating or treating it (by mitigation actions, transfer or termination of activities) in line with WHO’s risk management policy. While some risks must be avoided, certain risks may need to be taken to respond successfully to an emergency. The acceptable level of residual risk is expressed as the risk appetite, agreed by the Executive Director of the WHO Emergency Health Programme (WHE) or the regional director.
60. The WHE risk catalogue1 contains non-exhaustive examples of risks that exist across different types and scales of response and helps identify key risks that could affect the response. It also describes proven risk responses that can be adopted or adapted to the current setting.
70. Following the initial ORRA, an agreed risk response plan should address identified risks. The plan highlights the risks that require additional responses, including those that do not have an adequate level of response implemented.
Who performs the ORRA, and when?
80. Operational oversight of an emergency response includes preparing the ORRA (with input from all levels), managing it throughout the response and monitoring the effectiveness of risk response plans. Specific tasks can be delegated to other incident management team staff (such as the in-country field coordinator and IMS function leads) for multi-country or multi-site responses.
90. The incident management support team (IMST) includes a risk management focal point in the planning and monitoring function to ensure ongoing revision and reporting. Risk owners are appointed to monitor risks allocated to them and report back on the status of the risks. For large-scale responses, it is recommended that a risk management committee be established to oversee the risk register. This committee should include the incident manager and the leads of the critical IMS functions. It may include additional support from regional offices and WHO headquarters.
100. Drawing on past experiences and After Action Reviews and Intra Action Reviews from recent or ongoing responses, the focal points of the IMS critical functions should consider the key risks in their respective IMS function or subfunction relevant to the emergency or event.
110. An initial ORRA is to be prepared between 10 and 30 days from the sudden onset of an event or grading of an emergency, with a responsible focal point identified within ten days. Additional consultation with partners and national health authorities can be incorporated into the operational plan where relevant. Still, it should not delay the initial ORRA, which is shared with the regional office and the respective head of the WHO country office (HWCO) or WHO representative (WR).
120. Depending on the grade of the event, the initial ORRA will include a discussion with the regional office or WHO headquarters on the risk appetite level. The discussion will include an assessment of whether the target residual risk levels identified for each risk fall within the accepted range of risk tolerance. This ensures that mitigation measures will address the remaining gap between the current risk and the target risk level.
Monitoring the implementation and effect of the risk response plan
130. Following the initial assessment, periodic monitoring of the risk response plan is critical:
- Confirm adherence by ensuring actions planned in a set timeline are part of the day-to-day implementation activities and
- Evaluate effectiveness, by identifying indicators that can inform managers – through the measurement of positive outcomes or absence of negative outcomes – that the risk response is working.
140. Whenever possible, the periodic monitoring should use relevant response measures that are already collected (for example, the funding stream and rate of implementation, completeness of delivery, feedback on the effect of the support provided, stock-outs and timeliness of reporting).
When to evaluate and revise the ORRA
150. The frequency and depth of the ORRA review depend on the initial grading of the emergency response and is required immediately if the grade of the event escalates.
| It is recommended that the identification and assessment of risks in the ORRA is reviewed after one month and then quarterly thereafter by the regional emergency director (RED). The RED is expected to include in weekly coordination meetings an agenda item to confirm that adherence to the risk response plan is being monitored. |
| It is required that the ORRA is reviewed monthly by the RED to confirm that risk assumptions remain valid. The RED is expected to include in weekly coordination meetings an agenda item to confirm that adherence to the risk response plan is being monitored. |
| It is required that the ORRA is reviewed every two weeks (considering new risks and changes to the old risks) by the ExD. This involves inputs from regional offices and headquarters to confirm the identification of relevant risks and the related risk response plan and reconfirm the risk tolerance levels. Weekly meetings should use monitoring data to ensure that the assessed risks for which risk responses were planned have been sufficiently reduced. |
