Risk Evaluation and Acceptability Criteria

Why Risk Evaluation and Acceptability Criteria Matter

Every safety professional eventually faces the same hard question: How safe is safe enough? Identifying hazards and estimating risk are only the first steps. At some point, someone has to decide whether a given level of risk can be tolerated, whether more controls are required, or whether an activity should not proceed at all. That decision point is risk evaluation, and the standards used to make the decision are acceptability criteria.

For the BCSP Certified Safety Professional (CSP) exam, this topic sits squarely within the Risk Management domain and connects to nearly every other area of the blueprint: hazard analysis, management systems, risk communication, ethics, and the hierarchy of controls. Exam questions frequently test whether you can distinguish risk analysis from risk evaluation, whether you understand concepts such as ALARP and tolerable risk, and whether you can apply a decision framework to a scenario. Beyond the exam, this is the skill that separates a technician who fills in risk matrices from a professional who defends a defensible, documented, and ethically sound risk decision to management, regulators, and workers.

What Risk Evaluation Is

Most modern frameworks, including ISO 31000, ANSI/ASSP Z590.3 (Prevention through Design), ANSI/ASSP Z10 / ISO 45001, ISO 12100, and ANSI B11.0, describe risk assessment as a three-part process:

1. Risk identification – finding hazards and exposures.
2. Risk analysis – estimating the severity of consequences and the likelihood (probability and exposure frequency) of those consequences, producing a risk level or risk score.
3. Risk evaluation – comparing the analyzed risk against predetermined criteria to decide whether the risk is acceptable, tolerable, or unacceptable, and therefore whether treatment is required.

A common exam trap is confusing analysis with evaluation. Analysis answers how big the risk is. Evaluation answers whether that size is acceptable. The two together comprise risk assessment, and risk assessment plus risk treatment plus monitoring and communication comprise risk management.

Acceptability Criteria Defined

Acceptability criteria are the reference standards, established before the assessment, against which analyzed risk is judged. They may be:

- Qualitative: categories on a risk matrix (for example, Low, Medium, High, Very High) with pre-assigned actions for each.
- Semi-quantitative: numerical scores (such as a 1 to 25 matrix score, or a Risk Priority Number in FMEA) with threshold values that trigger required action.
- Quantitative: probabilities of harm per year or per exposure, such as an individual risk of fatality of 1 in 1,000,000 per year, or societal risk displayed on an F-N curve.

Criteria are typically derived from legal requirements, consensus standards, corporate policy, stakeholder expectations, industry benchmarks, and the organization's risk appetite (the amount and type of risk an organization is willing to pursue) and risk tolerance (the acceptable variation around objectives).

Key Terms You Must Know

Acceptable risk – Risk that has been reduced to a level the organization can tolerate given its legal obligations and its own policy, so that no further risk reduction is required. ANSI/ASSP Z590.3 defines acceptable risk as that level which can be tolerated by the organization considering legal, regulatory, ethical, and economic factors. Note the word tolerated, which signals that acceptable does not mean zero.

Tolerable risk – Terminology used heavily in ISO/IEC Guide 51 and the UK HSE framework. A tolerable risk is one that society or an organization is willing to live with in order to secure certain benefits, provided it is properly controlled and kept under review. Many standards now use acceptable and tolerable almost interchangeably, but the HSE model treats tolerable as a middle region that demands continual reduction effort.

Residual risk – The risk remaining after controls have been applied. Evaluation must be performed on residual risk, not on the raw inherent risk, to confirm the final state is acceptable.

ALARP (As Low As Reasonably Practicable) – The principle that risk must be reduced until the cost (in money, time, trouble) of further reduction would be grossly disproportionate to the benefit gained. ALARP comes from UK case law (Edwards v. National Coal Board, 1949) and is the backbone of the HSE tolerability framework. Note the asymmetry: the burden is on the duty holder to demonstrate that further reduction is grossly disproportionate, not merely that costs exceed benefits.

ALARA (As Low As Reasonably Achievable) – Used primarily in radiation protection (NRC, ICRP). Conceptually similar to ALARP but applied to dose minimization.

De minimis risk – A risk so small it is considered negligible and not worth regulating or further reducing. Regulators and courts often cite roughly 1 in 1,000,000 lifetime risk as a de minimis level for carcinogen exposure. The phrase comes from the Latin maxim that the law does not concern itself with trifles.

Significant risk – In U.S. regulatory law, the Supreme Court's Benzene decision (Industrial Union Department v. API, 1980) held that OSHA must show a significant risk exists before regulating. The Court suggested a 1 in 1,000 lifetime risk of death would clearly be significant while 1 in 1,000,000,000 would clearly not. This is a frequently cited anchor on the CSP exam.

Broadly acceptable region – In the HSE framework, risks below roughly 1 in 1,000,000 per year for the public are broadly acceptable and require no further action beyond maintaining controls.

Intolerable (unacceptable) region – Risks above an upper threshold (HSE uses about 1 in 1,000 per year for workers and 1 in 10,000 per year for the public) are unacceptable regardless of benefit; the activity must not proceed until risk is reduced.

Risk appetite vs. risk tolerance – Appetite is strategic and forward-looking (how much risk we are willing to seek). Tolerance is operational (how much deviation from the target we will accept).

Individual risk vs. societal risk – Individual risk is the probability a specific person is harmed. Societal risk considers the frequency of events that harm multiple people, often displayed on an F-N curve (frequency vs. number of fatalities). Society typically shows risk aversion toward high-consequence, low-frequency events, so criteria lines on F-N curves slope downward to penalize multi-fatality events more heavily.

How Risk Evaluation Works: The Process

Step 1: Establish the context and criteria first. Criteria must be set before analysis begins, not reverse-engineered afterward to make a project look acceptable. Define the matrix categories, score thresholds, or quantitative limits, and define who has authority to accept risk at each level.

Step 2: Perform risk analysis. Estimate severity and likelihood using the chosen technique (preliminary hazard analysis, job hazard analysis, FMEA, HAZOP, fault tree, LOPA, or quantitative risk assessment). Produce an initial risk rating.

Step 3: Compare against criteria. Place the risk in its region. Typical outcomes:
- Unacceptable: stop or do not start; redesign or add controls before proceeding.
- Tolerable only if ALARP: proceed only after demonstrating that reasonably practicable controls have been implemented and documented.
- Acceptable: proceed; maintain controls and monitor.

Step 4: Apply risk treatment using the hierarchy of controls. Elimination, substitution, engineering controls, warnings, administrative controls, and PPE, in that order of preference. ANSI Z590.3 expands the hierarchy to emphasize design-stage elimination and substitution.

Step 5: Re-evaluate residual risk. After treatment, repeat the comparison. Confirm residual risk falls in an acceptable or tolerable-with-ALARP region and that no new hazards were introduced by the controls.

Step 6: Document and obtain acceptance at the proper authority level. Many systems, such as MIL-STD-882E, explicitly tie the level of residual risk to the management level that must sign off. High risk may require the component acquisition executive; serious risk a program executive officer; medium risk a program manager; low risk the program manager or delegated authority. Acceptance of risk is a management decision with accountability, not a safety department decision alone.

Step 7: Communicate and monitor. Inform affected workers of residual risk and the controls that protect them. Reassess when conditions change, after incidents, or at scheduled intervals.

Common Decision Tools

Risk matrix. A grid of severity vs. likelihood. Each cell maps to an action category. Know the strengths (simple, communicable) and weaknesses (subjective, can compress very different risks into one cell, inconsistent between raters, may ignore exposure frequency unless added as a third dimension).

Risk Assessment Code (RAC). The MIL-STD-882 approach that assigns a number (1 through 20 in 882E, or categories I through IV with probability A through E) to represent combined severity and probability.

Risk Priority Number (RPN). In FMEA, Severity times Occurrence times Detection. Thresholds for action are organization-specific; a key point is that RPN should not be the sole criterion, since a severity-10 item with a low RPN still deserves attention.

Layer of Protection Analysis (LOPA). A semi-quantitative method that compares the mitigated event frequency to a target tolerable frequency (for example, 1 in 10,000 per year for a fatality scenario) and determines how many independent protection layers or what Safety Integrity Level is needed to close the gap.

Cost-benefit and cost-effectiveness analysis. Used to support ALARP demonstrations. Expressed as cost per statistical life saved or cost per unit of risk reduced. Regulators use a Value of a Statistical Life (U.S. agencies commonly cite figures in the range of roughly 10 to 13 million dollars) for comparison. Remember that cost-benefit informs but does not override the gross disproportion test, and it never justifies accepting an intolerable risk.

F-N curves. Plot cumulative frequency of events causing N or more fatalities against N on log-log axes. Criteria lines separate acceptable, ALARP, and unacceptable regions for societal risk.

Factors That Influence Acceptability

Risk evaluation is not purely mathematical. Risk perception research (Slovic, Fischhoff, and others) shows people and organizations accept more risk when it is voluntary, familiar, controllable, distributed fairly, delayed rather than immediate, and offers direct benefit. They reject risk that is involuntary, unfamiliar, catastrophic, dreaded, inequitable, or imposed on children or future generations. A CSP must recognize that worker acceptance of risk can be distorted by habituation and normalization of deviance, and that the professional obligation is to protect against risks workers have become comfortable with. Ethical codes, including the BCSP Code of Ethics, require holding the safety, health, and welfare of people paramount, which constrains how far economic arguments can push acceptability.

Worked Example 1: Matrix Application

A maintenance task on a conveyor requires reaching near an unguarded nip point weekly. Severity is rated Critical (permanent partial disability). Likelihood is rated Probable given weekly exposure. The organization's matrix places Critical-Probable in the High category, which policy defines as unacceptable without additional controls. Evaluation outcome: the task may not continue as currently performed. Treatment: install a fixed guard with an interlocked access door (engineering control), and establish lockout for any task requiring guard removal (administrative control). Re-analysis: Severity remains Critical (the energy has not been eliminated), but likelihood drops to Remote. Critical-Remote falls in the Medium category, which policy defines as tolerable with management approval and documented ALARP review. The supervisor-level manager signs the acceptance, and the residual risk is communicated at the next toolbox talk.

Worked Example 2: Quantitative Thresholds

A quantitative risk assessment estimates an individual fatality risk of 4 in 10,000 per year for an operator at a process unit. Using the HSE framework for workers (upper limit about 1 in 1,000, broadly acceptable below 1 in 1,000,000), this risk lies in the tolerable-if-ALARP region. The company evaluates adding a gas detection and automatic shutdown system costing 800,000 dollars that would cut the risk by half, averting roughly 0.0002 statistical fatalities per year, or about 0.006 over a 30-year life. The implied cost per statistical life saved exceeds 100 million dollars, well above typical VSL benchmarks, so the company could argue gross disproportion. However, a lower-cost option, revised operating procedures and relocating the control station, achieves nearly the same reduction for 60,000 dollars and is therefore reasonably practicable and must be implemented under ALARP. The exam point: ALARP requires considering all reasonably practicable options, not merely rejecting the most expensive one.

Exam Tips: Answering Questions on Risk Evaluation and Acceptability Criteria

1. Lock in the sequence. Identification, then analysis, then evaluation, then treatment. If a question asks which step compares estimated risk to criteria, the answer is evaluation. If it asks which step estimates severity and likelihood, the answer is analysis. Do not let similar-sounding distractors pull you toward assessment or treatment.

2. Acceptable is never zero. Any answer choice implying risk has been eliminated or that acceptable risk means no risk is almost always wrong. Look for language such as reduced to a level that can be tolerated considering legal, ethical, and economic factors.

3. Know the ALARP test precisely. The correct standard is gross disproportion between cost and benefit, with the burden on the duty holder. An option stating that controls are required only when benefits exceed costs misstates ALARP. An option stating that cost is never a consideration is also wrong, because reasonably practicable inherently involves cost.

4. Memorize the anchor numbers. De minimis is about 1 in 1,000,000. The Benzene decision used 1 in 1,000 as clearly significant. HSE upper tolerability is about 1 in 1,000 per year for workers and 1 in 10,000 per year for the public. These show up as direct recall items and as plausible distractors in calculation items.

5. Watch for the residual risk trap. If a scenario describes controls being added, the question is almost always asking about the residual risk, and the correct response is to re-evaluate after treatment, not to assume acceptance based on the original rating.

6. Criteria come first. Any answer suggesting criteria should be set after analysis, or adjusted to fit the results, violates ISO 31000 and Z590.3. Pre-established, documented criteria are the correct position.

7. Management accepts risk; safety professionals advise. When a question asks who has authority to accept residual risk, the answer points to management at the appropriate level (MIL-STD-882E ties authority to risk level), not the safety manager acting alone and not the affected worker.

8. Hierarchy of controls ties in. When asked how to make an unacceptable risk acceptable, prefer answers that reduce likelihood or severity through elimination, substitution, or engineering controls. PPE and training are rarely the best answer for moving a high risk into an acceptable range.

9. Severity usually cannot be reduced by administrative controls. In matrix questions, recognize that guards, lockout, and procedures mostly reduce likelihood; only elimination, substitution, or energy reduction lowers severity. Choose answer options consistent with this.

10. Distinguish individual and societal risk. If the stem mentions multiple fatalities, public exposure, or F-N curves, think societal risk and risk aversion. If it mentions a specific worker or location, think individual risk.

11. Read for perception cues. Questions about why workers or the public accept or reject certain risks are testing risk perception factors: voluntary vs. involuntary, familiar vs. dread, controllable vs. uncontrollable. Select the option that names these factors rather than one that attributes everything to ignorance or statistics.

12. Eliminate absolutes. Options using always, never, eliminate all risk, or regardless of cost are usually distractors. Risk evaluation is a balancing discipline bounded by law and ethics.

13. In calculation items, keep units straight. Risk is frequency times consequence. Lifetime risk versus annual risk is a common conversion trap; multiply annual risk by exposure years (often 45 working years for occupational lifetime, 70 years for the general public) when converting.

14. Connect to standards by name. ISO 31000 for the general framework, ANSI/ASSP Z590.3 for acceptable risk in design, ANSI/ASSP Z10 and ISO 45001 for management systems, ISO 12100 and ANSI B11.0 for machinery, MIL-STD-882E for system safety and risk acceptance authority, and HSE's Reducing Risks, Protecting People for the ALARP tolerability framework. Knowing which standard owns which concept earns easy points.

Quick Review Summary

Risk evaluation is the decision step in which analyzed risk is compared to pre-set criteria to determine whether it is acceptable, tolerable with ALARP demonstration, or unacceptable. Acceptability criteria may be qualitative matrices, semi-quantitative scores, or quantitative probability thresholds, and they derive from law, standards, policy, stakeholders, and risk appetite. Key frameworks include the three-region HSE model, ALARP with its gross disproportion test, de minimis and significant risk benchmarks from U.S. regulatory history, and MIL-STD-882E risk acceptance authority. Evaluation is performed on residual risk after controls are applied through the hierarchy, documented, accepted by management at the appropriate level, communicated to those affected, and revisited as conditions change. Master the sequence, the vocabulary, the anchor numbers, and the ethical limits, and you will handle any CSP question on this topic with confidence.