HSE ERM Control Ontology
This ontology defines the sets of owl classes to be used to instantiate Controls
Accept the level of risk based on existing information e.g. pursue the opportunity.
Accept
in order to monitor the action one person must have lead responsibility.
Action. owner
Actions are a future measure that will maintain and/or modify a risk. In the HSE, an action is a future measure to further reduce either the likelihood or impact of a risk.
Actions
Avoid/Terminate it completely e.g. do not proceed with the planned activity.
Avoid/terminate
Control owner
Controls are measures that maintain and/or modify risk. In the HSE, a control is a measure that is in place, is working effectively and operating to reduce either the likelihood or impact of a risk.
Controls
Corrective controls are designed to correct errors or undesirable events which have occurred and will prevent further occurrences.
Corrective controls
Current risk is the level of risk after both the existing controls and actions are considered at the point in time the risk is being assessed
Current risk
Detective controls are designed to search for and identify errors or undesirable events after they have occurred so that corrective actions can be taken.
Detective controls
Directive controls give direction. These can be, for example, statutory obligations, regulatory standards including professional standards, or other organisational requirements or instructions, many of which are converted into policies, procedures, circulars, standard operating procedures and training.
Directive controls
assurance from external independent assurance providers such as Regulators.
External Assurance providers
the way risks are managed and controlled day-to-day. Assurance comes directly from those responsible for delivering specific objectives or processes. Its value comes from those who know the business, culture and day-to-day challenges.
First line of defence
Inherent risk in the HSE is the level of risk before consideration of control and/or action measures.
Inherent risk
Initial risk is the level of risk after existing controls are considered when the risk was originally assessed.
Initial risk
Preventative controls are controls designed to stop, discourage, pre-empt or limit the possibility of an undesirable event before it occurs.
Preventative controls
Proactive controls are put in place before the risk materialises
Proactive controls
Residual risk in the HSE is the level of risk remaining after consideration of existing controls.
Residual risk
Reactive controlsfocus on what happens after the risk occurs or which identify weaknesses in our current controls
Reactive controls
Reduce the risk with further actions.
Reduce
Risk treatment is the process to modify risk.
Risk treatment
the way the organisation oversees the control framework so that it operates effectively. The assurance provided is separate from those responsible for delivery, but not independent of the management chain, such as risk and compliance functions.
Second line of defence
Target risk in the HSE is the planned level of risk after consideration of both control and action measures.
Target risk
objective and independent assurance, e.g. internal audit, providing reasonable (not absolute) assurance of the overall effectiveness of governance, risk management and controls.
Third line of defence
Transfer the risk e.g. to an identified individual or unit, that has been communicated to and notified, where many of the actions identified as required to mitigate are better managed and are within their span of control.
Transfer the risk
treatment plans detail both action and effective control plans, to minimise the likelihood and impact of the identified risk.
Treatmant plan