This website uses non-intrusive cookies to improve your user experience. You can visit our cookie privacy page for more information.

Institute of Risk Management Annual Lecture - speech - 3 December 2015

Judith Hackitt CBE, HSE Chair

"Alligators and Swamps – understanding the problems and finding the right solutions, in the right order"

Good morning everyone. What a great turnout – quality and quantity! It is an honour to be invited to give the Institute of Risk Management Annual Lecture. As the Chair of the Health and Safety Executive now, and with a career in chemical industries, risk management issues have never been far from the top of my agenda.

And over the years I have come to realise that people can have very different ideas and understanding about risk in general, about how to identify which risks really matter and how they can be managed effectively. Whilst my recent background is first and foremost health and safety risk management I hope to draw out parallels that show ultimately, we complicate matters by compartmentalising different types of risk, and considering them in isolation, at our peril.

Petrochemicals and plastics

My working career began back in 1975. Having graduated from Imperial College in Chemical Engineering, I entered the petrochemical industry to put what I had learnt into practice. As in any industry, innovation and new ideas are always needed to create new markets or simply to stay relevant. For example, from the 1950s onwards the petrochemical industry was heavily involved in the rapid invention, development and industrialisation of various new forms of plastic, to the point that by 1976 plastic had become the most used material in the world. How many of you can remember that very famous line from a film of that era, "The Graduate" where Benjamin is given career advice by a family friend "There’s a great future in plastics, Benjamin".

I can’t tell you what would have happened to Benjamin if he’d followed this advice rather than allowing himself to be seduced by Mrs Robinson, but I can tell you about my own experience, and that is what will form the substance of my presentation here today.

My background

I went to work for Exxon at Fawley in 1975 and it was an exciting place to be – exciting because of its complexity, because of the strong work ethic but also the commitment to the importance of what we were doing. And also because everyone clearly recognised there was a serious responsibility to do what we were doing safely. As with any major hazard industry, such invention and industrialisation cannot take place effectively, if at all, without identifying, understanding and managing the risks inherent in the processes and in any changes or modifications that might need to be made for any new process.

Risk management as an enabler

Risk management as an enabler of benefits; it sounds like a straightforward concept, an easy win-win; managing the risks puts a company in control and gives it the confidence to innovate and develop. This has been the way in well run companies for a long time. But organisational culture, pervading wider cultural attitudes to risk, general short sightedness and frankly a lack of professionalism can sometimes still lead to risks being ignored or overlooked – seen as an obstacle to simply swerve around or that someone else must be dealing with. Or in other cases dealing with all risks, even those that are incredibly inconsequential, has become the order of the day, which is actually getting in the way of people living their lives. This question of balance, getting the right approach to risk management will be central to what I say today.

I was trained well in my early career. As I drove into Fawley every day I was met by a large sign painted on the side of an oil storage tank which told me (and everyone else who entered through that gate) that "You are responsible for safety on this site". But it was about much more than slogans and signs. Safety truly was embedded in every facet of everyone’s role on the site. There are some aspects of what happened back then which I would not advocate now – safety incentive schemes which because of the way they were designed, actually led to injury reporting being suppressed rather than reported. But much of what I learned in my early days is still relevant today and I would dearly love to see some of those good practices which were instilled in me then introduced into a number of industries today in an appropriate way. Let me illustrate that by briefly describing how change management was handled – and remember that I am talking about a process that was in place back in the 1970s.

As a process engineer, it was my job to come up with good ideas to improve the plant – to use less energy, to improve yields or to make new products. My boss encouraged me to come up with good ideas – and to seek out ideas from operators and maintenance technicians. But it was very clear that not only did I need to come forward with a way of doing things, but a way of doing things safely. Having persuaded my immediate supervisor that my idea was sound, I then had to convince others – including the operators of the plant and those who would maintain it as well as more senior management. Only after all this could the change go ahead and only then if it was a relatively small change. For larger scale changes and capital projects this process was then followed by a review by a group of senior engineers and managers called "the Safe Operations Committee". Let me be clear, this was not bureaucracy; this was face to face discussion. It was a challenging process for me as a young engineer and it was meant to be. Only when everyone was happy that the change could be done and done safely did it go ahead.

As my career progressed and I became an Operations manager myself, I became a member of that Safe Operations Committee, reviewing and challenging the good ideas of others. My responsibility was different, but it was nonetheless clear what my responsibility was.

I knew the approach that I needed to take – and enable others to take – when I became Operations Director of a top tier COMAH site – COMAH stands for Control of Major Accident Hazards Regulations. By then, regulation had determined that for major hazard facilities such as the ones I had responsibility for, such work had to be documented in the form of a Safety Case for further review with the regulator. Having by this time spent close to 15 years in the Exxon safety culture, the safety case requirement was not difficult. The biggest challenge it presented to us, was not explaining what we were doing to the regulator, but the requirement to communicate the potential offsite impacts of an incident to local residents. But the challenge of engineers communicating more widely about what they do is another subject for another day. The key point about my early training was that managing risk and ensuring safety was an integral part of every role I was appointed to – my responsibilities were clear and so were everyone else’s, we all understood that.

Draining the swamps

So now let us return to the business today in 2015 of draining the swamp and looking out for alligators.

The title I have chosen for my lecture here today relates to my observation that in spite of the undoubted progress we have made in health and safety since the coincidental start of my career in the mid 70s and the introduction of the health and safety at work act, we have also managed to introduce levels of complexity and diversions into the system which have made things more difficult. We have created new roles which separate out responsibility rather than having clear and integrated ownership in everyone’s role at every level. Health and safety management has become a discipline in its own right as if it is somehow separate and different from all other management functions and responsibilities.

We are extremely fortunate here in the UK to have the very best health and safety system in the world. Many others have copied it because the principles are compelling. Indeed they mirror the approach that was engendered into me at the start of my career:

Do these principles apply in all cases – I would say "Yes" they do. I would go so far as to say that they apply beyond health and safety to other types of risk. It is in fact, what we all do all of the time in living our lives, but it seems we need to make matters significantly more complex when we get to work.

When I decide to leave home in the morning, I consider the weather. The weather - in particular the chances of it raining – is a hazard. It cannot be eliminated but I can manage the risk of my getting wet. (I have created the risk by deciding to expose myself to the elements). I could decide not to go out – thereby eliminating the risk but also placing a significant restriction on myself. Instead I decide whether or not to take an umbrella. There are no rules for this – sunny skies in the morning are no guarantee of a dry day – especially here in GB – I have to exercise judgment based on my own experience. I don’t go through that process consciously – because it has become part of my subconscious - but the principles are exactly the same as those I have highlighted. I could describe numerous other everyday examples but I want to move on to examining some of the complexity we have created around the subject of risk management, using the world of health and safety as my example.

Just over 8 years ago when I took on the role of Chair of HSE, I did so because I had the highest regard for the organisation and the role that it had played in delivering a world class performance across workplaces in all sectors of the economy. Even in those sectors where the numbers are still much higher than we would like them to be, we are considerably better than comparable sectors elsewhere in the world. But I was also concerned – that this system which others elsewhere in the world sought to copy – had somehow earned itself a very poor reputation here at home. Open any paper on any day and it was easy to find a ridiculous story about someone’s life being restricted by silly health and safety rules.


I was determined to get to the root of the problem and change perception. The task is not yet complete, but we have made a lot of progress. Our highly successful myth busting activity which started nearly four years ago has not only made a difference – it has also identified some of the root causes of the problem.

Baristas in coffee shops do NOT refuse to provide hot water to warm a baby’s bottle because of “elf n safety”. They say they do but the real reason is that they and their employers really don’t care about customer service – especially if you’re expecting the hot water to come for nothing.

Health And Safety notices appear in sports centre changing rooms asking people to use hair dryers only to dry the hair on their heads not because of health and safety but because people are using them for other purposes – I leave it to your imagination to work out what.

Ironing boards have not been banned on campsites because of health and safety – but because only a very few sad people were using them – who irons their clothes on a camping holiday for goodness sake??


I could go on, but if you want to read more take a look at HSE’s mythbuster website – there are more than 400 individual cases there now. The total number of enquiries we have dealt with is much higher than that but when we receive repeat or similar cases we simply refer enquirers to previous advice/decisions.

Why is this so important? Much of it is not about risk management at all - except for the fact that some of the risk-averse behaviour is driven by a fear of possible civil litigation, but we will come back to that later. Cynicism about health and safety based on cases like this, hyped up in the press, leads to a number of consequences:

Where does it start to go wrong? Very early I’m afraid. One of my greatest concerns is the impact on children of all of this risk averse, bureaucratic and nonsensical behaviour. I started off by telling you that my training in risk management began when I started work as a graduate. That isn’t true of course. One of my earliest lessons in risk management occurred at the tender age of 3 when I fell over and knocked my two front teeth out. It happened at home, I tripped over a mat. I didn’t sue my parents or the supplier of the mat, but I did learn to look where I was going!

Risk averse childhoods...

My ability to take on board the culture I encountered when I joined Exxon was built upon my own personal experiences up until then. I had a childhood where I took risks and I learned from them. My parents and my teachers enabled that to happen by exposing me to risk but they managed the level of risk to the best of their ability, kept me safe – most of the time - and I learned as a result.

Consider many of today’s children who are brought up in a cotton wool world – not allowed out to play, taught to regard all strangers with deep suspicion, not taken on school trips, not allowed to do science experiments for themselves....

...Means less risk awareness...

Risk averse parents and teachers will produce risk naïve young adults – poorly equipped to deal with the realities of the world around them, unable to discern real risk from trivia, not knowing who they can trust or believe and a liability in any workplace, if they do not have those basic skills to exercise judgment and take responsibility for themselves.

Communicating risk management & Education to schools

The solution to this problem is to expose children to hazards and equip them with the skills they need for life so that these can be built upon later – not to perpetuate the problem by continuing to create an overly protective environment with yet more rules, "advice" and restrictions in the workplace.

It would be nice if I could tell you that all of the myths I have encountered have been unrelated to health and safety regulations in the workplace, but that is not true. I have been astounded by some of the prescription which I have encountered.

What is clear however, is that this appears to be driven by an inability to discern or to instil in others what is reasonable, sensible and proportionate:
Rules exist in workplaces which ban people from doing what they do every day elsewhere in their lives

What is in the minds of the people who create these rules?
Some have told me that it is about creating the right culture. Some even call it a “Total Safety” culture which is presumably a reference to the time when “Total Quality management” was in vogue. Really? Is it not just possible that the people who read these prescriptive rules in the workplace think to themselves “what do they take me for? I’m not stupid.” The potential to create further cynicism towards health and safety by making these nannyish rules is very significant. I understand the need to create a culture where safety is important – I am a great advocate of just that. But health and safety is important when the consequences of not knowing the danger are significant. Risk management must be proportionate to the risk otherwise those on the receiving end get further confused about what matters, or even whether the people in charge know what the real risks are.

Some very serious incidents in recent years have demonstrated that there is not just potential, but actual evidence of focusing on the wrong risks or an incomplete picture of the risks and that it is all too often the really big ones get overlooked, with too much attention paid to smaller and less significant risks.

HSE's regulatory approach

Simplicity is key. Keep the rules to a minimum and establish principles. That is the basis of our world class system and it works when it is allowed to. Over complicating the rules and requirements leads to a lack of focus, or in some cases to the belief that doing what is required is all too difficult.

Simplicity is about stripping out what is not required, making it easy for people to understand what they need to do, focusing on what is important, keeping bureaucracy and paperwork to a minimum and enabling people and activities to go ahead, it is not about lowering standards or putting people at more risk. In fact the reverse is true – simplicity leads to greater commitment and buy-in which delivers better safety for everyone.

Straightforward guidance

I must pause at this point to say that there is much to be cheerful about. Although I have encountered many things that concern me I have also come across many examples of people doing exactly what is needed. There are many companies out there who understand and are doing health and safety as an integral part of running their business. It is seamless.

London 2012

We saw it on the Olympics project where safety, productivity and focus on success and legacy went hand in hand. More recently I have seen it at Babcock in Rosyth where they are building the Queen Elizabeth class aircraft carriers. Teams are motivated to be successful and success is understood by everyone to include getting safety right. No-one talks about safety in terms of bad things happening if you get it wrong, nor do they talk about the need for compliance with rules and regulations. It is all about getting the culture right and world class operation. Ask people who work there what they think, as I did, and they will tell you it’s the best place they’ve ever worked.

Our safety record here in the UK bears witness to the fact that many of the 1 million plus businesses out there are getting it right.

A world class system

We know there is a great deal of effort going into health and safety in many places. But given that our performance is the best in the world, why do so many people still see health and safety as a drag and a burden rather than a success story?

One reason is probably that it’s difficult to celebrate success when there are still tragic stories of unnecessary deaths and serious injuries every year – not from new causes but from the same things continuing to happen – falls from height, trapped by or under vehicles, people caught in machinery or equipment that wasn’t properly locked out.

But no room for complacency

And then there is the toll of ill health which we estimate causes in excess of 12000 people to die prematurely each year because of harm done to them by work. There is no doubt that we need to focus our attention on causes of work related ill health just as much as safety, but in both cases it needs to be the right attention applied in the right way to achieve results.

Health issues

I have been impressed to see some industry sectors getting to grips with their most pressing work related health issues recently. Both the Construction industry and the ceramics industry know that their priority is to address exposure to respirable crystalline silica which causes chronic lung disease in later life. In other sectors like healthcare and education the priority is more likely to be mental ill health related issues such as stress or perhaps muscular skeletal problems. Here again the key to motivation and being effective is to focus on the real risks not on those that are easiest to promote simply to demonstrate that you are doing something.

So, I understand and share the view that there is scope to improve our performance still further. But how do we do that? This must be the key question.

For some the answer is "we must do more, we must find all of the risks and manage them", generating yet more paperwork and procedures. But the research is clear – doing things because we are told to doesn’t work for many of us at all and even for those who it does, they only do it while they’re being watched. In a recent discussion in Australia I encountered a new phenomenon of "wilful compliance" – where people obey the rules even if they know it doesn’t make sense or isn’t right – because if it goes wrong it will be the rulemaker’s fault not theirs. If we want to make behaviour change stick we need to take time to explain why and make it easy for people to do. And we must not insult people’s intelligence by telling them that they need to tie their shoe laces – or as one of my old bosses used to call it "Nose blowing and bottom wiping"!

How can improvements be made?

This is key. I do not believe that endless checklists of trivia and reminders to do the most basic things create a strong safety culture. Evidence suggests that such a bureaucratic and prescriptive approach creates a culture disempowerment, scepticism and inability or unwillingness to think for oneself

I have been shocked by the amount of paperwork that continues to be generated in the name of health and safety which serves no useful purpose. Even after we have stripped out more than 60% of regulations that were on the statute books, dutyholders still complain about the paperwork and bureaucracy. But what is it for? Who is it for?

Safety management systems are fine if they are fit for purpose, but the purpose is to ensure that work is done safely and effectively. Folders which gather dust in the manager’s office serve no purpose, especially if they do not reflect what is actually done by the workforce on the shopfloor – either because they cut corners or, in many cases because they know a better and simpler way, if you only bothered to ask (Remember what I told you about who I had to consult with in my first job??).

I talked about the very natural process of risk assessment earlier and I want to return to it now. I want to explore how we have lost sight of the purpose and turned risk assessment into a paperwork exercise which often duplicates other perfectly good and sufficient processes which already take place and are integral to the management of the business.

In the process industries where I have spent most of my working life, it is firmly established practice to generate permits to work on equipment which has been taken out of live service for maintenance work to be carried out. No-one would argue that this is a time of high risk because processes which are normally contained are about to be broken into. The permit system requires a clear statement of what is to be done and by whom. It asks what steps have been taken to isolate the equipment. It asks what precautions the maintenance team will need to take and any special conditions they need to be made aware of. At the end of the job there is an equally thorough series of questions which need to be answered before the equipment can be handed over to be put back into service again. What is this if not a thorough and integral process of risk assessment and management as the job proceeds?

It systematises all of those steps I described earlier:

Let us look at another sector – the care sector. Here it is common practice for care workers to produce care plans for vulnerable patients/residents. They will describe what they can and cannot be given to eat and drink, how they can be moved, what treatment is to be given, any particular issues about the patient which the carer needs to be aware of and so on. Again assessing the risks to the worker and the patient/resident is fully integrated into the work plan.

We have in the last 2 years issued guidance on work experience placements to the education sector making it clear that they do not need to do risk assessments for every single work placement. They DO need to assure themselves that the employer has assessed the particular risks of employing young inexperienced people, but that is sufficient.

Why then do we encounter in these and other sectors, the existence of stand-alone risk assessments which duplicate without adding value? Who are they for? Not the regulator – we require risk to be assessed and managed and communicated effectively to those for whom it is relevant and in all but the smallest companies we ask for a record to be kept that risk assessments have been done.

Helping demystify risk assessments

We offer some simple examples of how that might be done to help smaller businesses via our website and accompanying guidance but we do not specify that it must be a separate stand-alone exercise. Here is an example of how we collectively breed alligators and forget that the task is to drain the swamp.

I am clear that businesses create these paper monsters because they think they have to, not because they are addicted to bureaucracy – but we need to understand where this perceived requirement comes from.


I said that I would return to the subject of civil litigation. Much of the paperwork alligators in our systems today are driven by fear of civil litigation. Local authorities place requirements on schools, insurers place requirements on employers in order to manage potential claims. Extensive lists of documents required in order to defend possible claims are often quoted to us as a reason for so much paperwork. We have to get to grips with this monster because it is getting in the way of good health and safety – because it demotivates those who need to be leading, inspiring and creating the right sort of culture. I am confident that there are some of you in the audience here today who can help us with this – or you can continue to snap your jaws and sharpen your teeth.

You will be relieved to hear that I have one final “alligator” that I would like to address before I hand over to you to ask questions. But this is a slightly different alligator – in that I believe it has the potential to be helpful rather than a hindrance if we learn how to deploy it correctly. This one is called the health and safety professional. I know that I have ruffled more than a few feathers recently by remarks made on a radio programme about the number of health and safety professionals.

Here is my concern. I started off describing to you the way in which I was trained to manage health and safety as an integral part of my job, being clear what my responsibilities were at every level as I progressed in my career. I was not then and still am not now, an expert in every aspect of health and safety management. I know what I know, and more importantly, I know what I don’t know. That means I know when I need to seek advice from others who are more expert than me in a particular area – be that Occupational Health or cyber threats which could compromise a critical process control system or whatever other specialist discipline I require.

But the key is that specialists are there to advise and support employees and line management at every level. Responsibility for managing safety must stay integral to every level of the business, it cannot be delegated or transferred to the Health and safety manager or to a consultant. Leadership must come from the top and must be cascaded down the line, with everyone understanding their roles and responsibilities Expertise and advice from specialists should be valued and welcomed because it is relevant and proportionate. You know there is a problem with the culture when anyone in any organisation says "that’s not my job, that’s what the health safety manager does".

So, my case is this, when managers learn to lead and own health and safety, when they recognise that to do so is integral to good business management and have the confidence they need to do it simply and well they will also know when and where to call upon the valuable advice of health and safety professionals – preferably specialists rather than generalists. When this happens health and safety professionals become a valuable resource. They become facilitators and enablers. But let’s be clear that they do not – should not – manage health and safety because it takes responsibility away from where it belongs.

I may be about to step down from this magnificent role that I have had for the last eight and a half years, but I will never cease to care and to feel passionately that no business can claim to be good unless it cares about the health and safety of its workforce and the impact of its operations/business on others. Doing it well is not difficult if the culture is right and the commitment is there, but it is easy to lose sight of what good really looks like. The right culture is built on valuing and motivating people and engaging them not on systems and bureaucracy. If you have not yet read Steve Hilton’s book "Being More Human" than I would strongly recommend it.

Someone else with whom I have had the privilege of sharing a speaking platform on many occasions and who happens to know an awful lot about the Nimrod disaster regularly quotes EF Schumacher to our audience. It seems appropriate that I should conclude my presentation today with that same quotation:
"Any intelligent fool can make things bigger, more complex, and more violent. It takes a touch of genius, and a lot of courage, to move in the opposite direction"

Thank you

We need courage and genius to fight the alligators and to get back to draining the swamp – that is how we can become the very best we can be. I have stuck to what I know here today – management of health and safety - but I have no doubt at all that the thoughts I have outlined here are much more widely applicable to our world today. When we create so much complexity that no one understands the system, we cannot manage the system or the risks and no one knows who is responsible for what. It is a familiar cry that goes beyond the world of health and safety.

Thank you for listening. You may agree or you may disagree with some or all of what I have said to you today. These are my personal views, learned throughout my career and I am happy to debate them. I only hope that I have given you food for thought and cause to reflect.

Updated 2016-03-24