Acceptable risk

What is acceptable risk?

No activity has zero risk. Risk assessment estimates a probability and severity for each hazard, and the organization must decide, using explicit criteria, which combinations require action, how urgently, and which can be kept under control and monitored. This boundary is the acceptable or tolerable risk. The INSST risk assessment document uses a probability and consequences matrix that classifies risk as trivial, tolerable, moderate, significant, and intolerable, and associates an action with each level: from requiring no specific action to prohibiting the work to reducing the risk.

Acceptability has three sources of criteria. The legal source establishes non-negotiable minimums: exposure limit values, safety requirements for equipment and locations, prohibitions, and distances; no risk that violates regulations is acceptable. The technical source provides methods, standards, and best practices for estimating and comparing risks, such as the principle of reducing them to the lowest reasonably achievable level. And the organizational and social source reflects company policy, consultation with representatives, and the perceptions of exposed individuals, which may demand stricter levels than those required by law.

The concept is similar to that of residual risk (the risk that remains after implementing measures), but it is not the same: residual risk is an estimated fact; acceptable risk is a criterion that is decided upon and against which the residual risk is compared. A residual risk may or may not be acceptable according to that criterion.

Criteria and methods

• Legal compliance. Prerequisite: limit values ​​(noise, vibrations, chemical agents), minimum provisions of places and equipment, specific regulations; exceeding these makes the risk unacceptable regardless of other criteria.
• Risk matrices. Combination of probability and severity with associated levels and actions, such as the INSST matrix or those of management standards; they require documented and consistent criteria.
• Reasonable reduction. Principle of reducing risk to the extent reasonably practicable, weighing the safety benefit against the effort, without admitting that the cost justifies maintaining significant risks.
• Quantitative methods. In process installations, protection layer analysis, fault trees and individual and social risk criteria that define numerical thresholds, used in major accidents.
• Participation. Consult the worker safety representatives on the criteria and on the assessment of specific risks, in accordance with article 33 of Law 31/1995.
• Review. The criteria are reviewed based on the evolution of knowledge, regulations, and the organization’s experience (incidents, audits).

Application in management

• Prioritization. Comparing the assessed risk with the acceptability criterion determines the urgency and order of the measures in preventive planning.
• Maintaining controls. An acceptable risk is acceptable as long as the measures that make it acceptable are operational: maintenance, training, supervision, and health monitoring.
• Change management. Any change in equipment, processes, organization, or people requires a reassessment of whether the risk remains acceptable.
• Communication. Exposed individuals must be aware of the residual risk, the measures that control it, and their role in maintaining them.
• Record keeping. The criteria used and acceptance decisions are documented in the risk assessment to ensure traceability.

Organizational application: how to define and apply acceptability

1. Document the acceptability criteria in the prevention plan: legal compliance as a prerequisite, matrix or assessment method, and actions associated with each level.
2. Consult the criteria with the worker safety representatives and have them approved by management.
3. Apply the criteria consistently in the risk assessment, recording for each risk its level, the existing measures and the decision.
4. Plan measures for unacceptable risks in order of priority, with responsible parties and deadlines, and maintenance measures for acceptable risks.
5. Periodically verify that the controls that support acceptability remain operational (inspections, maintenance, current training).
6. Re-evaluate in the event of changes, incidents, or new technical or regulatory information.
7. Review the criteria in the annual system review and in the audits.

Preventive management software allows you to parameterize the assessment matrix, apply the same criteria in all evaluations, automatically prioritize planning, and alert when a control associated with an acceptable risk is no longer valid.

Limits and common mistakes

1. To consider acceptable a risk that does not meet legal limit values ​​or minimum requirements.
2. Accepting risks for cost without having applied the hierarchy of controls or justified the decision.
3. Using matrices without documented criteria or applying them differently depending on the evaluator.
4. Forgetting that acceptability depends on controls being maintained, and not verifying their validity.
5. Do not reassess after changes or incidents that alter the probability or severity.
6. Deciding on acceptability without consulting representatives or informing exposed persons.

The decision on acceptability rests with the organization with the technical advice of the prevention service; this sheet is for informational purposes.

Regulatory and reference framework

• Law 31/1995, articles 15, 16 and 33. Principles of preventive action, risk assessment and consultation with workers.
• Royal Decree 39/1997, articles 3 to 6. Risk assessment: criteria, procedure and review.
• Basic guidelines for the assessment of occupational risks, INSST (2021) . General assessment method with risk levels and associated actions.
• ISO 45001. Determination of risks that require measures according to the organization’s criteria.
• Royal Decree 840/2015, of September 21. Risk analysis and acceptability criteria in establishments affected by major accidents.

ISO 31000 defines risk criteria as the terms of reference against which the significance of risk is assessed; in the field of functional safety, the IEC 61508 and IEC 61511 series set tolerable risk criteria for safety systems.