What is Composite Risk Management (CRM)?

Composite Risk Management (CRM) refers to a systematic approach dedicated to creating a safe space by identifying, assessing, and controlling risks and hazards. It is a tool for managers or supervisors to make sound decisions in a logical thought process where they can identify and control hazards. This decision-making process was designed to eliminate deficit outcomes and maximize opportunities, particularly in the U.S. Army, however, it can be utilized in different workplace sectors.

Here’s a more detailed breakdown of the process:

Identify Hazards: Take a look around your environment and identify potential hazards that pose a significant risk of bodily harm or injury. This can mean malfunctioning equipment, extreme weather conditions, or lack of safety signage.
Assess Hazards: After hazard identification, evaluate the level of harm or injury a hazard poses. It’s crucial to estimate the severity of the hazard and its likelihood of occurring in the design process of a procedure.
Control Hazards: After their assessment, you can now design an efficient safety system that minimizes the interaction between such hazards.

Steps in The CRM Process

risk assessment

Risk Identification: The first step in CRM is identifying potential risks associated with a specific activity or operation. This involves a thorough analysis of potential hazards, vulnerabilities, and external factors that could impact the mission.
Risk Assessment: Once risks are identified, they must be assessed in terms of probability, severity, and potential consequences. This step helps prioritize risks and allocate resources accordingly.
Risk Mitigation: After assessing risks, strategies and measures are put in place to mitigate, eliminate, or contain potential hazards. This may involve implementing safety protocols, utilizing protective equipment, or altering operational procedures.
Risk Monitoring and Review: CRM is an iterative process. Continuous monitoring of risks and their mitigation measures is essential to ensure that they remain relevant and effective. Regular reviews and updates to the CRM plan are crucial for adapting to evolving circumstances.
Risk Communication: Clear and effective communication is vital in CRM. All stakeholders involved in an activity or operation must be informed of potential risks, mitigation strategies, and their respective roles in the risk management process.

Risk Assessment Matrix

One of the key elements of a CRM worksheet is the CRM Matrix, which looks at weighing the probability and severity of a potential tasks. The chart risk values are:

E = Extremely High
H = High
M = Moderate
L = Low

Risk Assessment Matrix			Probability
			Frequent	Likely	Occasional	Seldom	Unlikely
			A	B	C	D	E
Severity	Catastrophic	I	E	E	H	H	M
	Critical	II	E	H	H	M	L
	Marginal	III	H	M	M	L	L
	Negligible	IV	M	L	L	L	L

While an A1 risk type needs to be addressed immediately, an E4 risk type may be ok to deprioritize until later. Understanding where your risk factors are can help organize your process.

Additional CRM facts:

Composite Risk Management (CRM) is a process for decision-making developed by the US military to acknowledge, assess, and address hazards and control risks- during missions, operations, and even day-to-day activities. Source: https://www.compositeriskmanagement.net/what-is-composite-risk-management/
CRM is a systematic approach that helps identify, assess, and control risks by applying the five steps of CRM: identify hazards, assess hazards, develop controls and make decisions, supervise and evaluate, and implement controls. Source: https://teamonenetwork.com/wp-content/uploads/2019/01/FiveStepCompositeRiskManagementProcess.pdf
CRM can be applied to any situation or activity that involves risk, such as combat operations, training, maintenance, recreation, and daily life. CRM helps to enhance mission effectiveness, reduce losses, and preserve resources. Source: https://riskpublishing.com/what-is-composite-risk-management-crm/
CRM is not a one-time event, but a continuous process that requires constant monitoring and feedback. CRM also involves communication and coordination among all levels of command and staff, as well as individual responsibility and accountability. Source: https://www.financialworkshopkits.org/an-in-depth-exploration-of-composite-risk-management/
CRM can be integrated with other risk management frameworks, such as ISO 31000, which provides principles and guidelines for managing risk in any organization or context. Source: https://www.iso.org/iso-31000-risk-management.html